ndr_marshall.c

Go to the documentation of this file.

/*
 * NDR data marshalling
 *
 * Copyright 2002 Greg Turner
 * Copyright 2003-2006 CodeWeavers
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 *
 * TODO:
 *  - String structs
 *  - Byte count pointers
 *  - transmit_as/represent as
 *  - Multi-dimensional arrays
 *  - Conversion functions (NdrConvert)
 *  - Checks for integer addition overflow in user marshall functions
 */
 
#include <assert.h>
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <limits.h>
 
#define NONAMELESSUNION
#include "windef.h"
#include "winbase.h"
#include "winerror.h"
 
#include "ndr_misc.h"
#include "rpcndr.h"
#include "ndrtypes.h"
 
#include "wine/debug.h"
 
WINE_DEFAULT_DEBUG_CHANNEL(ole);
 
#if defined(__i386__)
# define LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32) \
    (*((UINT32 *)(pchar)) = (uint32))
 
# define LITTLE_ENDIAN_UINT32_READ(pchar) \
    (*((UINT32 *)(pchar)))
#else
  /* these would work for i386 too, but less efficient */
# define LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32) \
    (*(pchar)     = LOBYTE(LOWORD(uint32)), \
     *((pchar)+1) = HIBYTE(LOWORD(uint32)), \
     *((pchar)+2) = LOBYTE(HIWORD(uint32)), \
     *((pchar)+3) = HIBYTE(HIWORD(uint32)))
 
# define LITTLE_ENDIAN_UINT32_READ(pchar) \
    (MAKELONG( \
      MAKEWORD(*(pchar), *((pchar)+1)), \
      MAKEWORD(*((pchar)+2), *((pchar)+3))))
#endif
 
#define BIG_ENDIAN_UINT32_WRITE(pchar, uint32) \
  (*((pchar)+3) = LOBYTE(LOWORD(uint32)), \
   *((pchar)+2) = HIBYTE(LOWORD(uint32)), \
   *((pchar)+1) = LOBYTE(HIWORD(uint32)), \
   *(pchar)     = HIBYTE(HIWORD(uint32)))
 
#define BIG_ENDIAN_UINT32_READ(pchar) \
  (MAKELONG( \
    MAKEWORD(*((pchar)+3), *((pchar)+2)), \
    MAKEWORD(*((pchar)+1), *(pchar))))
 
#ifdef NDR_LOCAL_IS_BIG_ENDIAN
# define NDR_LOCAL_UINT32_WRITE(pchar, uint32) \
    BIG_ENDIAN_UINT32_WRITE(pchar, uint32)
# define NDR_LOCAL_UINT32_READ(pchar) \
    BIG_ENDIAN_UINT32_READ(pchar)
#else
# define NDR_LOCAL_UINT32_WRITE(pchar, uint32) \
    LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32)
# define NDR_LOCAL_UINT32_READ(pchar) \
    LITTLE_ENDIAN_UINT32_READ(pchar)
#endif
 
static inline void align_length( ULONG *len, unsigned int align )
{
    *len = (*len + align - 1) & ~(align - 1);
}
 
static inline void align_pointer( unsigned char **ptr, unsigned int align )
{
    ULONG_PTR mask = align - 1;
    *ptr = (unsigned char *)(((ULONG_PTR)*ptr + mask) & ~mask);
}
 
static inline void align_pointer_clear( unsigned char **ptr, unsigned int align )
{
    ULONG_PTR mask = align - 1;
    memset( *ptr, 0, (align - (ULONG_PTR)*ptr) & mask );
    *ptr = (unsigned char *)(((ULONG_PTR)*ptr + mask) & ~mask);
}
 
static inline void align_pointer_offset( unsigned char **ptr, unsigned char *base, unsigned int align )
{
    ULONG_PTR mask = align - 1;
    *ptr = base + (((ULONG_PTR)(*ptr - base) + mask) & ~mask);
}
 
static inline void align_pointer_offset_clear( unsigned char **ptr, unsigned char *base, unsigned int align )
{
    ULONG_PTR mask = align - 1;
    memset( *ptr, 0, (align - (ULONG_PTR)(*ptr - base)) & mask );
    *ptr = base + (((ULONG_PTR)(*ptr - base) + mask) & ~mask);
}
 
#define STD_OVERFLOW_CHECK(_Msg) do { \
    TRACE("buffer=%d/%d\n", (ULONG)(_Msg->Buffer - (unsigned char *)_Msg->RpcMsg->Buffer), _Msg->BufferLength); \
    if (_Msg->Buffer > (unsigned char *)_Msg->RpcMsg->Buffer + _Msg->BufferLength) \
        ERR("buffer overflow %d bytes\n", (ULONG)(_Msg->Buffer - ((unsigned char *)_Msg->RpcMsg->Buffer + _Msg->BufferLength))); \
  } while (0)
 
#define NDR_POINTER_ID_BASE 0x20000
#define NDR_POINTER_ID(pStubMsg) (NDR_POINTER_ID_BASE + ((pStubMsg)->UniquePtrCount++) * 4)
#define NDR_TABLE_SIZE 128
#define NDR_TABLE_MASK 127
 
static unsigned char *WINAPI NdrBaseTypeMarshall(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
static unsigned char *WINAPI NdrBaseTypeUnmarshall(PMIDL_STUB_MESSAGE, unsigned char **, PFORMAT_STRING, unsigned char);
static void WINAPI NdrBaseTypeBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
static void WINAPI NdrBaseTypeFree(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
static ULONG WINAPI NdrBaseTypeMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
 
static unsigned char *WINAPI NdrContextHandleMarshall(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
static void WINAPI NdrContextHandleBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
static unsigned char *WINAPI NdrContextHandleUnmarshall(PMIDL_STUB_MESSAGE, unsigned char **, PFORMAT_STRING, unsigned char);
 
static unsigned char *WINAPI NdrRangeMarshall(PMIDL_STUB_MESSAGE,unsigned char *, PFORMAT_STRING);
static void WINAPI NdrRangeBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
static ULONG WINAPI NdrRangeMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
static void WINAPI NdrRangeFree(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
 
static ULONG WINAPI NdrByteCountPointerMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
 
static unsigned char * ComplexBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                         unsigned char *pMemory,
                                         PFORMAT_STRING pFormat,
                                         PFORMAT_STRING pPointer);
static unsigned char * ComplexMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                       unsigned char *pMemory,
                                       PFORMAT_STRING pFormat,
                                       PFORMAT_STRING pPointer);
static unsigned char * ComplexUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                         unsigned char *pMemory,
                                         PFORMAT_STRING pFormat,
                                         PFORMAT_STRING pPointer,
                                         unsigned char fMustAlloc);
static ULONG ComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                     PFORMAT_STRING pFormat,
                                     PFORMAT_STRING pPointer);
static unsigned char * ComplexFree(PMIDL_STUB_MESSAGE pStubMsg,
                                   unsigned char *pMemory,
                                   PFORMAT_STRING pFormat,
                                   PFORMAT_STRING pPointer);
 
const NDR_MARSHALL NdrMarshaller[NDR_TABLE_SIZE] = {
  0,
  NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
  NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
  NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
  NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
  /* 0x10 */
  NdrBaseTypeMarshall,
  /* 0x11 */
  NdrPointerMarshall, NdrPointerMarshall,
  NdrPointerMarshall, NdrPointerMarshall,
  /* 0x15 */
  NdrSimpleStructMarshall, NdrSimpleStructMarshall,
  NdrConformantStructMarshall, NdrConformantStructMarshall,
  NdrConformantVaryingStructMarshall,
  NdrComplexStructMarshall,
  /* 0x1b */
  NdrConformantArrayMarshall, 
  NdrConformantVaryingArrayMarshall,
  NdrFixedArrayMarshall, NdrFixedArrayMarshall,
  NdrVaryingArrayMarshall, NdrVaryingArrayMarshall,
  NdrComplexArrayMarshall,
  /* 0x22 */
  NdrConformantStringMarshall, 0, 0,
  NdrConformantStringMarshall,
  NdrNonConformantStringMarshall, 0, 0, 0,
  /* 0x2a */
  NdrEncapsulatedUnionMarshall,
  NdrNonEncapsulatedUnionMarshall,
  NdrByteCountPointerMarshall,
  NdrXmitOrRepAsMarshall, NdrXmitOrRepAsMarshall,
  /* 0x2f */
  NdrInterfacePointerMarshall,
  /* 0x30 */
  NdrContextHandleMarshall,
  /* 0xb1 */
  0, 0, 0,
  NdrUserMarshalMarshall,
  0, 0,
  /* 0xb7 */
  NdrRangeMarshall,
  NdrBaseTypeMarshall,
  NdrBaseTypeMarshall
};
const NDR_UNMARSHALL NdrUnmarshaller[NDR_TABLE_SIZE] = {
  0,
  NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
  NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
  NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
  NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
  /* 0x10 */
  NdrBaseTypeUnmarshall,
  /* 0x11 */
  NdrPointerUnmarshall, NdrPointerUnmarshall,
  NdrPointerUnmarshall, NdrPointerUnmarshall,
  /* 0x15 */
  NdrSimpleStructUnmarshall, NdrSimpleStructUnmarshall,
  NdrConformantStructUnmarshall, NdrConformantStructUnmarshall,
  NdrConformantVaryingStructUnmarshall,
  NdrComplexStructUnmarshall,
  /* 0x1b */
  NdrConformantArrayUnmarshall, 
  NdrConformantVaryingArrayUnmarshall,
  NdrFixedArrayUnmarshall, NdrFixedArrayUnmarshall,
  NdrVaryingArrayUnmarshall, NdrVaryingArrayUnmarshall,
  NdrComplexArrayUnmarshall,
  /* 0x22 */
  NdrConformantStringUnmarshall, 0, 0,
  NdrConformantStringUnmarshall,
  NdrNonConformantStringUnmarshall, 0, 0, 0,
  /* 0x2a */
  NdrEncapsulatedUnionUnmarshall,
  NdrNonEncapsulatedUnionUnmarshall,
  NdrByteCountPointerUnmarshall,
  NdrXmitOrRepAsUnmarshall, NdrXmitOrRepAsUnmarshall,
  /* 0x2f */
  NdrInterfacePointerUnmarshall,
  /* 0x30 */
  NdrContextHandleUnmarshall,
  /* 0xb1 */
  0, 0, 0,
  NdrUserMarshalUnmarshall,
  0, 0,
  /* 0xb7 */
  NdrRangeUnmarshall,
  NdrBaseTypeUnmarshall,
  NdrBaseTypeUnmarshall
};
const NDR_BUFFERSIZE NdrBufferSizer[NDR_TABLE_SIZE] = {
  0,
  NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
  NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
  NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
  NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
  /* 0x10 */
  NdrBaseTypeBufferSize,
  /* 0x11 */
  NdrPointerBufferSize, NdrPointerBufferSize,
  NdrPointerBufferSize, NdrPointerBufferSize,
  /* 0x15 */
  NdrSimpleStructBufferSize, NdrSimpleStructBufferSize,
  NdrConformantStructBufferSize, NdrConformantStructBufferSize,
  NdrConformantVaryingStructBufferSize,
  NdrComplexStructBufferSize,
  /* 0x1b */
  NdrConformantArrayBufferSize, 
  NdrConformantVaryingArrayBufferSize,
  NdrFixedArrayBufferSize, NdrFixedArrayBufferSize,
  NdrVaryingArrayBufferSize, NdrVaryingArrayBufferSize,
  NdrComplexArrayBufferSize,
  /* 0x22 */
  NdrConformantStringBufferSize, 0, 0,
  NdrConformantStringBufferSize,
  NdrNonConformantStringBufferSize, 0, 0, 0,
  /* 0x2a */
  NdrEncapsulatedUnionBufferSize,
  NdrNonEncapsulatedUnionBufferSize,
  NdrByteCountPointerBufferSize,
  NdrXmitOrRepAsBufferSize, NdrXmitOrRepAsBufferSize,
  /* 0x2f */
  NdrInterfacePointerBufferSize,
  /* 0x30 */
  NdrContextHandleBufferSize,
  /* 0xb1 */
  0, 0, 0,
  NdrUserMarshalBufferSize,
  0, 0,
  /* 0xb7 */
  NdrRangeBufferSize,
  NdrBaseTypeBufferSize,
  NdrBaseTypeBufferSize
};
const NDR_MEMORYSIZE NdrMemorySizer[NDR_TABLE_SIZE] = {
  0,
  NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
  NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
  NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
  NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
  /* 0x10 */
  NdrBaseTypeMemorySize,
  /* 0x11 */
  NdrPointerMemorySize, NdrPointerMemorySize,
  NdrPointerMemorySize, NdrPointerMemorySize,
  /* 0x15 */
  NdrSimpleStructMemorySize, NdrSimpleStructMemorySize,
  NdrConformantStructMemorySize, NdrConformantStructMemorySize,
  NdrConformantVaryingStructMemorySize,
  NdrComplexStructMemorySize,
  /* 0x1b */
  NdrConformantArrayMemorySize,
  NdrConformantVaryingArrayMemorySize,
  NdrFixedArrayMemorySize, NdrFixedArrayMemorySize,
  NdrVaryingArrayMemorySize, NdrVaryingArrayMemorySize,
  NdrComplexArrayMemorySize,
  /* 0x22 */
  NdrConformantStringMemorySize, 0, 0,
  NdrConformantStringMemorySize,
  NdrNonConformantStringMemorySize, 0, 0, 0,
  /* 0x2a */
  NdrEncapsulatedUnionMemorySize,
  NdrNonEncapsulatedUnionMemorySize,
  NdrByteCountPointerMemorySize,
  NdrXmitOrRepAsMemorySize, NdrXmitOrRepAsMemorySize,
  /* 0x2f */
  NdrInterfacePointerMemorySize,
  /* 0x30 */
  0,
  /* 0xb1 */
  0, 0, 0,
  NdrUserMarshalMemorySize,
  0, 0,
  /* 0xb7 */
  NdrRangeMemorySize,
  NdrBaseTypeMemorySize,
  NdrBaseTypeMemorySize
};
const NDR_FREE NdrFreer[NDR_TABLE_SIZE] = {
  0,
  NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
  NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
  NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
  NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
  /* 0x10 */
  NdrBaseTypeFree,
  /* 0x11 */
  NdrPointerFree, NdrPointerFree,
  NdrPointerFree, NdrPointerFree,
  /* 0x15 */
  NdrSimpleStructFree, NdrSimpleStructFree,
  NdrConformantStructFree, NdrConformantStructFree,
  NdrConformantVaryingStructFree,
  NdrComplexStructFree,
  /* 0x1b */
  NdrConformantArrayFree, 
  NdrConformantVaryingArrayFree,
  NdrFixedArrayFree, NdrFixedArrayFree,
  NdrVaryingArrayFree, NdrVaryingArrayFree,
  NdrComplexArrayFree,
  /* 0x22 */
  0, 0, 0,
  0, 0, 0, 0, 0,
  /* 0x2a */
  NdrEncapsulatedUnionFree,
  NdrNonEncapsulatedUnionFree,
  0,
  NdrXmitOrRepAsFree, NdrXmitOrRepAsFree,
  /* 0x2f */
  NdrInterfacePointerFree,
  /* 0x30 */
  0,
  /* 0xb1 */
  0, 0, 0,
  NdrUserMarshalFree,
  0, 0,
  /* 0xb7 */
  NdrRangeFree,
  NdrBaseTypeFree,
  NdrBaseTypeFree
};
 
typedef struct _NDR_MEMORY_LIST
{
    ULONG magic;
    ULONG size;
    ULONG reserved;
    struct _NDR_MEMORY_LIST *next;
} NDR_MEMORY_LIST;
 
#define MEML_MAGIC  ('M' << 24 | 'E' << 16 | 'M' << 8 | 'L')
 
/***********************************************************************
 *            NdrAllocate [RPCRT4.@]
 *
 * Allocates a block of memory using pStubMsg->pfnAllocate.
 *
 * PARAMS
 *  pStubMsg [I/O] MIDL_STUB_MESSAGE structure.
 *  len      [I]   Size of memory block to allocate.
 *
 * RETURNS
 *  The memory block of size len that was allocated.
 *
 * NOTES
 *  The memory block is always 8-byte aligned.
 *  If the function is unable to allocate memory an RPC_X_NO_MEMORY
 *  exception is raised.
 */
void * WINAPI NdrAllocate(MIDL_STUB_MESSAGE *pStubMsg, SIZE_T len)
{
    SIZE_T aligned_len;
    SIZE_T adjusted_len;
    void *p;
    NDR_MEMORY_LIST *mem_list;
 
    aligned_len = (len + 7) & ~7;
    adjusted_len = aligned_len + sizeof(NDR_MEMORY_LIST);
    /* check for overflow */
    if (adjusted_len < len)
    {
        ERR("overflow of adjusted_len %ld, len %ld\n", adjusted_len, len);
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    }
 
    p = pStubMsg->pfnAllocate(adjusted_len);
    if (!p) RpcRaiseException(RPC_X_NO_MEMORY);
 
    mem_list = (NDR_MEMORY_LIST *)((char *)p + aligned_len);
    mem_list->magic = MEML_MAGIC;
    mem_list->size = aligned_len;
    mem_list->reserved = 0;
    mem_list->next = pStubMsg->pMemoryList;
    pStubMsg->pMemoryList = mem_list;
 
    TRACE("-- %p\n", p);
    return p;
}
 
static void *NdrAllocateZero(MIDL_STUB_MESSAGE *stubmsg, SIZE_T len)
{
    void *mem = NdrAllocate(stubmsg, len);
    memset(mem, 0, len);
    return mem;
}
 
static void NdrFree(MIDL_STUB_MESSAGE *pStubMsg, unsigned char *Pointer)
{
    TRACE("(%p, %p)\n", pStubMsg, Pointer);
 
    pStubMsg->pfnFree(Pointer);
}
 
static inline BOOL IsConformanceOrVariancePresent(PFORMAT_STRING pFormat)
{
    return (*(const ULONG *)pFormat != -1);
}
 
static inline PFORMAT_STRING SkipConformance(const PMIDL_STUB_MESSAGE pStubMsg, const PFORMAT_STRING pFormat)
{
    return pFormat + 4 + pStubMsg->CorrDespIncrement;
}
 
static PFORMAT_STRING ReadConformance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat)
{
  align_pointer(&pStubMsg->Buffer, 4);
  if (pStubMsg->Buffer + 4 > pStubMsg->BufferEnd)
      RpcRaiseException(RPC_X_BAD_STUB_DATA);
  pStubMsg->MaxCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
  pStubMsg->Buffer += 4;
  TRACE("unmarshalled conformance is %ld\n", pStubMsg->MaxCount);
  return SkipConformance(pStubMsg, pFormat);
}
 
static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat, ULONG MaxValue)
{
  if (pFormat && !IsConformanceOrVariancePresent(pFormat))
  {
    pStubMsg->Offset = 0;
    pStubMsg->ActualCount = pStubMsg->MaxCount;
    goto done;
  }
 
  align_pointer(&pStubMsg->Buffer, 4);
  if (pStubMsg->Buffer + 8 > pStubMsg->BufferEnd)
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  pStubMsg->Offset      = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
  pStubMsg->Buffer += 4;
  TRACE("offset is %d\n", pStubMsg->Offset);
  pStubMsg->ActualCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
  pStubMsg->Buffer += 4;
  TRACE("variance is %d\n", pStubMsg->ActualCount);
 
  if ((pStubMsg->ActualCount > MaxValue) ||
      (pStubMsg->ActualCount + pStubMsg->Offset > MaxValue))
  {
    ERR("invalid array bound(s): ActualCount = %d, Offset = %d, MaxValue = %d\n",
        pStubMsg->ActualCount, pStubMsg->Offset, MaxValue);
    RpcRaiseException(RPC_S_INVALID_BOUND);
    return NULL;
  }
 
done:
  return SkipConformance(pStubMsg, pFormat);
}
 
/* writes the conformance value to the buffer */
static inline void WriteConformance(MIDL_STUB_MESSAGE *pStubMsg)
{
    align_pointer_clear(&pStubMsg->Buffer, 4);
    if (pStubMsg->Buffer + 4 > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength)
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->MaxCount);
    pStubMsg->Buffer += 4;
}
 
/* writes the variance values to the buffer */
static inline void WriteVariance(MIDL_STUB_MESSAGE *pStubMsg)
{
    align_pointer_clear(&pStubMsg->Buffer, 4);
    if (pStubMsg->Buffer + 8 > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength)
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->Offset);
    pStubMsg->Buffer += 4;
    NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->ActualCount);
    pStubMsg->Buffer += 4;
}
 
/* requests buffer space for the conformance value */
static inline void SizeConformance(MIDL_STUB_MESSAGE *pStubMsg)
{
    align_length(&pStubMsg->BufferLength, 4);
    if (pStubMsg->BufferLength + 4 < pStubMsg->BufferLength)
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    pStubMsg->BufferLength += 4;
}
 
/* requests buffer space for the variance values */
static inline void SizeVariance(MIDL_STUB_MESSAGE *pStubMsg)
{
    align_length(&pStubMsg->BufferLength, 4);
    if (pStubMsg->BufferLength + 8 < pStubMsg->BufferLength)
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    pStubMsg->BufferLength += 8;
}
 
PFORMAT_STRING ComputeConformanceOrVariance(
    MIDL_STUB_MESSAGE *pStubMsg, unsigned char *pMemory,
    PFORMAT_STRING pFormat, ULONG_PTR def, ULONG_PTR *pCount)
{
  BYTE dtype = pFormat[0] & 0xf;
  short ofs = *(const short *)&pFormat[2];
  LPVOID ptr = NULL;
  ULONG_PTR data = 0;
 
  if (!IsConformanceOrVariancePresent(pFormat)) {
    /* null descriptor */
    *pCount = def;
    goto finish_conf;
  }
 
  switch (pFormat[0] & 0xf0) {
  case FC_NORMAL_CONFORMANCE:
    TRACE("normal conformance, ofs=%d\n", ofs);
    ptr = pMemory;
    break;
  case FC_POINTER_CONFORMANCE:
    TRACE("pointer conformance, ofs=%d\n", ofs);
    ptr = pStubMsg->Memory;
    break;
  case FC_TOP_LEVEL_CONFORMANCE:
    TRACE("toplevel conformance, ofs=%d\n", ofs);
    if (pStubMsg->StackTop) {
      ptr = pStubMsg->StackTop;
    }
    else {
      /* -Os mode, *pCount is already set */
      goto finish_conf;
    }
    break;
  case FC_CONSTANT_CONFORMANCE:
    data = ofs | ((DWORD)pFormat[1] << 16);
    TRACE("constant conformance, val=%ld\n", data);
    *pCount = data;
    goto finish_conf;
  case FC_TOP_LEVEL_MULTID_CONFORMANCE:
    FIXME("toplevel multidimensional conformance, ofs=%d\n", ofs);
    if (pStubMsg->StackTop) {
      ptr = pStubMsg->StackTop;
    }
    else {
      /* ? */
      goto done_conf_grab;
    }
    break;
  default:
    FIXME("unknown conformance type %x, expect crash.\n", pFormat[0] & 0xf0);
    goto finish_conf;
  }
 
  switch (pFormat[1]) {
  case FC_DEREFERENCE:
    ptr = *(LPVOID*)((char *)ptr + ofs);
    break;
  case FC_CALLBACK:
  {
    unsigned char *old_stack_top = pStubMsg->StackTop;
    ULONG_PTR max_count, old_max_count = pStubMsg->MaxCount;
 
    pStubMsg->StackTop = ptr;
 
    /* ofs is index into StubDesc->apfnExprEval */
    TRACE("callback conformance into apfnExprEval[%d]\n", ofs);
    pStubMsg->StubDesc->apfnExprEval[ofs](pStubMsg);
 
    pStubMsg->StackTop = old_stack_top;
 
    /* the callback function always stores the computed value in MaxCount */
    max_count = pStubMsg->MaxCount;
    pStubMsg->MaxCount = old_max_count;
    *pCount = max_count;
    goto finish_conf;
  }
  default:
    ptr = (char *)ptr + ofs;
    break;
  }
 
  switch (dtype) {
  case FC_LONG:
  case FC_ULONG:
    data = *(DWORD*)ptr;
    break;
  case FC_SHORT:
    data = *(SHORT*)ptr;
    break;
  case FC_USHORT:
    data = *(USHORT*)ptr;
    break;
  case FC_CHAR:
  case FC_SMALL:
    data = *(CHAR*)ptr;
    break;
  case FC_BYTE:
  case FC_USMALL:
    data = *(UCHAR*)ptr;
    break;
  case FC_HYPER:
    data = *(ULONGLONG *)ptr;
    break;
  default:
    FIXME("unknown conformance data type %x\n", dtype);
    goto done_conf_grab;
  }
  TRACE("dereferenced data type %x at %p, got %ld\n", dtype, ptr, data);
 
done_conf_grab:
  switch (pFormat[1]) {
  case FC_DEREFERENCE: /* already handled */
  case 0: /* no op */
    *pCount = data;
    break;
  case FC_ADD_1:
    *pCount = data + 1;
    break;
  case FC_SUB_1:
    *pCount = data - 1;
    break;
  case FC_MULT_2:
    *pCount = data * 2;
    break;
  case FC_DIV_2:
    *pCount = data / 2;
    break;
  default:
    FIXME("unknown conformance op %d\n", pFormat[1]);
    goto finish_conf;
  }
 
finish_conf:
  TRACE("resulting conformance is %ld\n", *pCount);
 
  return SkipConformance(pStubMsg, pFormat);
}
 
static inline PFORMAT_STRING SkipVariance(PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
{
    return SkipConformance( pStubMsg, pFormat );
}
 
/* multiply two numbers together, raising an RPC_S_INVALID_BOUND exception if
 * the result overflows 32-bits */
static inline ULONG safe_multiply(ULONG a, ULONG b)
{
    ULONGLONG ret = (ULONGLONG)a * b;
    if (ret > 0xffffffff)
    {
        RpcRaiseException(RPC_S_INVALID_BOUND);
        return 0;
    }
    return ret;
}
 
static inline void safe_buffer_increment(MIDL_STUB_MESSAGE *pStubMsg, ULONG size)
{
    if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
        (pStubMsg->Buffer + size > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength))
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    pStubMsg->Buffer += size;
}
 
static inline void safe_buffer_length_increment(MIDL_STUB_MESSAGE *pStubMsg, ULONG size)
{
    if (pStubMsg->BufferLength + size < pStubMsg->BufferLength) /* integer overflow of pStubMsg->BufferSize */
    {
        ERR("buffer length overflow - BufferLength = %u, size = %u\n",
            pStubMsg->BufferLength, size);
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    }
    pStubMsg->BufferLength += size;
}
 
/* copies data from the buffer, checking that there is enough data in the buffer
 * to do so */
static inline void safe_copy_from_buffer(MIDL_STUB_MESSAGE *pStubMsg, void *p, ULONG size)
{
    if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
        (pStubMsg->Buffer + size > pStubMsg->BufferEnd))
    {
        ERR("buffer overflow - Buffer = %p, BufferEnd = %p, size = %u\n",
            pStubMsg->Buffer, pStubMsg->BufferEnd, size);
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    }
    if (p == pStubMsg->Buffer)
        ERR("pointer is the same as the buffer\n");
    memcpy(p, pStubMsg->Buffer, size);
    pStubMsg->Buffer += size;
}
 
/* copies data to the buffer, checking that there is enough space to do so */
static inline void safe_copy_to_buffer(MIDL_STUB_MESSAGE *pStubMsg, const void *p, ULONG size)
{
    if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
        (pStubMsg->Buffer + size > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength))
    {
        ERR("buffer overflow - Buffer = %p, BufferEnd = %p, size = %u\n",
            pStubMsg->Buffer, (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength,
            size);
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    }
    memcpy(pStubMsg->Buffer, p, size);
    pStubMsg->Buffer += size;
}
 
/* verify that string data sitting in the buffer is valid and safe to
 * unmarshall */
static void validate_string_data(MIDL_STUB_MESSAGE *pStubMsg, ULONG bufsize, ULONG esize)
{
    ULONG i;
 
    /* verify the buffer is safe to access */
    if ((pStubMsg->Buffer + bufsize < pStubMsg->Buffer) ||
        (pStubMsg->Buffer + bufsize > pStubMsg->BufferEnd))
    {
        ERR("bufsize 0x%x exceeded buffer end %p of buffer %p\n", bufsize,
            pStubMsg->BufferEnd, pStubMsg->Buffer);
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    }
 
    /* strings must always have null terminating bytes */
    if (bufsize < esize)
    {
        ERR("invalid string length of %d\n", bufsize / esize);
        RpcRaiseException(RPC_S_INVALID_BOUND);
    }
 
    for (i = bufsize - esize; i < bufsize; i++)
        if (pStubMsg->Buffer[i] != 0)
        {
            ERR("string not null-terminated at byte position %d, data is 0x%x\n",
                i, pStubMsg->Buffer[i]);
            RpcRaiseException(RPC_S_INVALID_BOUND);
        }
}
 
static inline void dump_pointer_attr(unsigned char attr)
{
    if (attr & FC_ALLOCATE_ALL_NODES)
        TRACE(" FC_ALLOCATE_ALL_NODES");
    if (attr & FC_DONT_FREE)
        TRACE(" FC_DONT_FREE");
    if (attr & FC_ALLOCED_ON_STACK)
        TRACE(" FC_ALLOCED_ON_STACK");
    if (attr & FC_SIMPLE_POINTER)
        TRACE(" FC_SIMPLE_POINTER");
    if (attr & FC_POINTER_DEREF)
        TRACE(" FC_POINTER_DEREF");
    TRACE("\n");
}
 
/***********************************************************************
 *           PointerMarshall [internal]
 */
static void PointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                            unsigned char *Buffer,
                            unsigned char *Pointer,
                            PFORMAT_STRING pFormat)
{
  unsigned type = pFormat[0], attr = pFormat[1];
  PFORMAT_STRING desc;
  NDR_MARSHALL m;
  ULONG pointer_id;
  BOOL pointer_needs_marshaling;
 
  TRACE("(%p,%p,%p,%p)\n", pStubMsg, Buffer, Pointer, pFormat);
  TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
  pFormat += 2;
  if (attr & FC_SIMPLE_POINTER) desc = pFormat;
  else desc = pFormat + *(const SHORT*)pFormat;
 
  switch (type) {
  case FC_RP: /* ref pointer (always non-null) */
    if (!Pointer)
    {
      ERR("NULL ref pointer is not allowed\n");
      RpcRaiseException(RPC_X_NULL_REF_POINTER);
    }
    pointer_needs_marshaling = TRUE;
    break;
  case FC_UP: /* unique pointer */
  case FC_OP: /* object pointer - same as unique here */
    if (Pointer)
      pointer_needs_marshaling = TRUE;
    else
      pointer_needs_marshaling = FALSE;
    pointer_id = Pointer ? NDR_POINTER_ID(pStubMsg) : 0;
    TRACE("writing 0x%08x to buffer\n", pointer_id);
    NDR_LOCAL_UINT32_WRITE(Buffer, pointer_id);
    break;
  case FC_FP:
    pointer_needs_marshaling = !NdrFullPointerQueryPointer(
      pStubMsg->FullPtrXlatTables, Pointer, 1, &pointer_id);
    TRACE("writing 0x%08x to buffer\n", pointer_id);
    NDR_LOCAL_UINT32_WRITE(Buffer, pointer_id);
    break;
  default:
    FIXME("unhandled ptr type=%02x\n", type);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
    return;
  }
 
  TRACE("calling marshaller for type 0x%x\n", (int)*desc);
 
  if (pointer_needs_marshaling) {
    if (attr & FC_POINTER_DEREF) {
      Pointer = *(unsigned char**)Pointer;
      TRACE("deref => %p\n", Pointer);
    }
    m = NdrMarshaller[*desc & NDR_TABLE_MASK];
    if (m) m(pStubMsg, Pointer, desc);
    else FIXME("no marshaller for data type=%02x\n", *desc);
  }
 
  STD_OVERFLOW_CHECK(pStubMsg);
}
 
/* pPointer is the pointer that we will unmarshal into; pSrcPointer is the
 * pointer to memory which we may attempt to reuse if non-NULL. Usually these
 * are the same; for the case when they aren't, see EmbeddedPointerUnmarshall().
 *
 * fMustAlloc seems to determine whether we can allocate from the buffer (if we
 * are on the server side). It's ignored here, since we can't allocate a pointer
 * from the buffer. */
static void PointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                              unsigned char *Buffer,
                              unsigned char **pPointer,
                              unsigned char *pSrcPointer,
                              PFORMAT_STRING pFormat,
                              unsigned char fMustAlloc)
{
  unsigned type = pFormat[0], attr = pFormat[1];
  PFORMAT_STRING desc;
  NDR_UNMARSHALL m;
  DWORD pointer_id = 0;
  BOOL pointer_needs_unmarshaling, need_alloc = FALSE, inner_must_alloc = FALSE;
 
  TRACE("(%p,%p,%p,%p,%p,%d)\n", pStubMsg, Buffer, pPointer, pSrcPointer, pFormat, fMustAlloc);
  TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
  pFormat += 2;
  if (attr & FC_SIMPLE_POINTER) desc = pFormat;
  else desc = pFormat + *(const SHORT*)pFormat;
 
  switch (type) {
  case FC_RP: /* ref pointer (always non-null) */
    pointer_needs_unmarshaling = TRUE;
    break;
  case FC_UP: /* unique pointer */
    pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
    TRACE("pointer_id is 0x%08x\n", pointer_id);
    if (pointer_id)
      pointer_needs_unmarshaling = TRUE;
    else {
      *pPointer = NULL;
      pointer_needs_unmarshaling = FALSE;
    }
    break;
  case FC_OP: /* object pointer - we must free data before overwriting it */
    pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
    TRACE("pointer_id is 0x%08x\n", pointer_id);
 
    /* An object pointer always allocates new memory (it cannot point to the
     * buffer). */
    inner_must_alloc = TRUE;
 
    if (pSrcPointer)
        FIXME("free object pointer %p\n", pSrcPointer);
    if (pointer_id)
      pointer_needs_unmarshaling = TRUE;
    else
    {
      *pPointer = NULL;    
      pointer_needs_unmarshaling = FALSE;
    }
    break;
  case FC_FP:
    pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
    TRACE("pointer_id is 0x%08x\n", pointer_id);
    pointer_needs_unmarshaling = !NdrFullPointerQueryRefId(
      pStubMsg->FullPtrXlatTables, pointer_id, 1, (void **)pPointer);
    break;
  default:
    FIXME("unhandled ptr type=%02x\n", type);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
    return;
  }
 
  if (pointer_needs_unmarshaling) {
    unsigned char **current_ptr = pPointer;
    if (pStubMsg->IsClient) {
      TRACE("client\n");
      /* Try to use the existing (source) pointer to unmarshall the data into
       * so that [in, out] or [out, ref] parameters behave correctly. If the
       * source pointer is NULL and we are not dereferencing, we must force the
       * inner marshalling routine to allocate, since otherwise it will crash. */
      if (pSrcPointer)
      {
        TRACE("setting *pPointer to %p\n", pSrcPointer);
        *pPointer = pSrcPointer;
      }
      else
        need_alloc = inner_must_alloc = TRUE;
    } else {
      TRACE("server\n");
      /* We can use an existing source pointer here only if it is on-stack,
       * probably since otherwise NdrPointerFree() might later try to free a
       * pointer we don't know the provenance of. Otherwise we must always
       * allocate if we are dereferencing. We never need to force the inner
       * routine to allocate here, since it will either write into an existing
       * pointer, or use a pointer to the buffer. */
      if (attr & FC_POINTER_DEREF)
      {
        if (pSrcPointer && (attr & FC_ALLOCED_ON_STACK))
          *pPointer = pSrcPointer;
        else
          need_alloc = TRUE;
      }
      else
        *pPointer = NULL;
    }
 
    if (attr & FC_ALLOCATE_ALL_NODES)
        FIXME("FC_ALLOCATE_ALL_NODES not implemented\n");
 
    if (attr & FC_POINTER_DEREF) {
      if (need_alloc)
        *pPointer = NdrAllocateZero(pStubMsg, sizeof(void *));
 
      current_ptr = *(unsigned char***)current_ptr;
      TRACE("deref => %p\n", current_ptr);
    }
    m = NdrUnmarshaller[*desc & NDR_TABLE_MASK];
    if (m) m(pStubMsg, current_ptr, desc, inner_must_alloc);
    else FIXME("no unmarshaller for data type=%02x\n", *desc);
 
    if (type == FC_FP)
      NdrFullPointerInsertRefId(pStubMsg->FullPtrXlatTables, pointer_id,
                                *pPointer);
  }
 
  TRACE("pointer=%p\n", *pPointer);
}
 
/***********************************************************************
 *           PointerBufferSize [internal]
 */
static void PointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                              unsigned char *Pointer,
                              PFORMAT_STRING pFormat)
{
  unsigned type = pFormat[0], attr = pFormat[1];
  PFORMAT_STRING desc;
  NDR_BUFFERSIZE m;
  BOOL pointer_needs_sizing;
  ULONG pointer_id;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, Pointer, pFormat);
  TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
  pFormat += 2;
  if (attr & FC_SIMPLE_POINTER) desc = pFormat;
  else desc = pFormat + *(const SHORT*)pFormat;
 
  switch (type) {
  case FC_RP: /* ref pointer (always non-null) */
    if (!Pointer)
    {
      ERR("NULL ref pointer is not allowed\n");
      RpcRaiseException(RPC_X_NULL_REF_POINTER);
    }
    break;
  case FC_OP:
  case FC_UP:
    /* NULL pointer has no further representation */
    if (!Pointer)
        return;
    break;
  case FC_FP:
    pointer_needs_sizing = !NdrFullPointerQueryPointer(
      pStubMsg->FullPtrXlatTables, Pointer, 0, &pointer_id);
    if (!pointer_needs_sizing)
      return;
    break;
  default:
    FIXME("unhandled ptr type=%02x\n", type);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
    return;
  }
 
  if (attr & FC_POINTER_DEREF) {
    Pointer = *(unsigned char**)Pointer;
    TRACE("deref => %p\n", Pointer);
  }
 
  m = NdrBufferSizer[*desc & NDR_TABLE_MASK];
  if (m) m(pStubMsg, Pointer, desc);
  else FIXME("no buffersizer for data type=%02x\n", *desc);
}
 
/***********************************************************************
 *           PointerMemorySize [internal]
 */
static ULONG PointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                               unsigned char *Buffer, PFORMAT_STRING pFormat)
{
  unsigned type = pFormat[0], attr = pFormat[1];
  PFORMAT_STRING desc;
  NDR_MEMORYSIZE m;
  DWORD pointer_id = 0;
  BOOL pointer_needs_sizing;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, Buffer, pFormat);
  TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
  pFormat += 2;
  if (attr & FC_SIMPLE_POINTER) desc = pFormat;
  else desc = pFormat + *(const SHORT*)pFormat;
 
  switch (type) {
  case FC_RP: /* ref pointer (always non-null) */
    pointer_needs_sizing = TRUE;
    break;
  case FC_UP: /* unique pointer */
  case FC_OP: /* object pointer - we must free data before overwriting it */
    pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
    TRACE("pointer_id is 0x%08x\n", pointer_id);
    if (pointer_id)
      pointer_needs_sizing = TRUE;
    else
      pointer_needs_sizing = FALSE;
    break;
  case FC_FP:
  {
    void *pointer;
    pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
    TRACE("pointer_id is 0x%08x\n", pointer_id);
    pointer_needs_sizing = !NdrFullPointerQueryRefId(
      pStubMsg->FullPtrXlatTables, pointer_id, 1, &pointer);
    break;
  }
  default:
    FIXME("unhandled ptr type=%02x\n", type);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
    return 0;
  }
 
  if (attr & FC_POINTER_DEREF) {
    align_length(&pStubMsg->MemorySize, sizeof(void*));
    pStubMsg->MemorySize += sizeof(void*);
    TRACE("deref\n");
  }
 
  if (pointer_needs_sizing) {
    m = NdrMemorySizer[*desc & NDR_TABLE_MASK];
    if (m) m(pStubMsg, desc);
    else FIXME("no memorysizer for data type=%02x\n", *desc);
  }
 
  return pStubMsg->MemorySize;
}
 
/***********************************************************************
 *           PointerFree [internal]
 */
static void PointerFree(PMIDL_STUB_MESSAGE pStubMsg,
                        unsigned char *Pointer,
                        PFORMAT_STRING pFormat)
{
  unsigned type = pFormat[0], attr = pFormat[1];
  PFORMAT_STRING desc;
  NDR_FREE m;
  unsigned char *current_pointer = Pointer;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, Pointer, pFormat);
  TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
  if (attr & FC_DONT_FREE) return;
  pFormat += 2;
  if (attr & FC_SIMPLE_POINTER) desc = pFormat;
  else desc = pFormat + *(const SHORT*)pFormat;
 
  if (!Pointer) return;
 
  if (type == FC_FP) {
    int pointer_needs_freeing = NdrFullPointerFree(
      pStubMsg->FullPtrXlatTables, Pointer);
    if (!pointer_needs_freeing)
      return;
  }
 
  if (attr & FC_POINTER_DEREF) {
    current_pointer = *(unsigned char**)Pointer;
    TRACE("deref => %p\n", current_pointer);
  }
 
  m = NdrFreer[*desc & NDR_TABLE_MASK];
  if (m) m(pStubMsg, current_pointer, desc);
 
  /* this check stops us from trying to free buffer memory. we don't have to
   * worry about clients, since they won't call this function.
   * we don't have to check for the buffer being reallocated because
   * BufferStart and BufferEnd won't be reset when allocating memory for
   * sending the response. we don't have to check for the new buffer here as
   * it won't be used a type memory, only for buffer memory */
  if (Pointer >= pStubMsg->BufferStart && Pointer <= pStubMsg->BufferEnd)
      goto notfree;
 
  if (attr & FC_ALLOCED_ON_STACK) {
    TRACE("not freeing stack ptr %p\n", Pointer);
    return;
  }
  TRACE("freeing %p\n", Pointer);
  NdrFree(pStubMsg, Pointer);
  return;
notfree:
  TRACE("not freeing %p\n", Pointer);
}
 
/***********************************************************************
 *           EmbeddedPointerMarshall
 */
static unsigned char * EmbeddedPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                               unsigned char *pMemory,
                                               PFORMAT_STRING pFormat)
{
  unsigned char *Mark = pStubMsg->BufferMark;
  unsigned rep, count, stride;
  unsigned i;
  unsigned char *saved_buffer = NULL;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  if (*pFormat != FC_PP) return NULL;
  pFormat += 2;
 
  if (pStubMsg->PointerBufferMark)
  {
    saved_buffer = pStubMsg->Buffer;
    pStubMsg->Buffer = pStubMsg->PointerBufferMark;
    pStubMsg->PointerBufferMark = NULL;
  }
 
  while (pFormat[0] != FC_END) {
    switch (pFormat[0]) {
    default:
      FIXME("unknown repeat type %d; assuming no repeat\n", pFormat[0]);
      /* fallthrough */
    case FC_NO_REPEAT:
      rep = 1;
      stride = 0;
      count = 1;
      pFormat += 2;
      break;
    case FC_FIXED_REPEAT:
      rep = *(const WORD*)&pFormat[2];
      stride = *(const WORD*)&pFormat[4];
      count = *(const WORD*)&pFormat[8];
      pFormat += 10;
      break;
    case FC_VARIABLE_REPEAT:
      rep = (pFormat[1] == FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
      stride = *(const WORD*)&pFormat[2];
      count = *(const WORD*)&pFormat[6];
      pFormat += 8;
      break;
    }
    for (i = 0; i < rep; i++) {
      PFORMAT_STRING info = pFormat;
      unsigned char *membase = pMemory + (i * stride);
      unsigned char *bufbase = Mark + (i * stride);
      unsigned u;
 
      for (u=0; u<count; u++,info+=8) {
        unsigned char *memptr = membase + *(const SHORT*)&info[0];
        unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
        unsigned char *saved_memory = pStubMsg->Memory;
 
        pStubMsg->Memory = membase;
        PointerMarshall(pStubMsg, bufptr, *(unsigned char**)memptr, info+4);
        pStubMsg->Memory = saved_memory;
      }
    }
    pFormat += 8 * count;
  }
 
  if (saved_buffer)
  {
    pStubMsg->PointerBufferMark = pStubMsg->Buffer;
    pStubMsg->Buffer = saved_buffer;
  }
 
  STD_OVERFLOW_CHECK(pStubMsg);
 
  return NULL;
}
 
/* rpcrt4 does something bizarre with embedded pointers: instead of copying the
 * struct/array/union from the buffer to memory and then unmarshalling pointers
 * into it, it unmarshals pointers into the buffer itself and then copies it to
 * memory. However, it will still attempt to use a user-supplied pointer where
 * appropriate (i.e. one on stack). Therefore we need to pass both pointers to
 * this function and to PointerUnmarshall: the pointer (to the buffer) that we
 * will actually unmarshal into (pDstBuffer), and the pointer (to memory) that
 * we will attempt to use for storage if possible (pSrcMemoryPtrs). */
static unsigned char * EmbeddedPointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                                 unsigned char *pDstBuffer,
                                                 unsigned char *pSrcMemoryPtrs,
                                                 PFORMAT_STRING pFormat,
                                                 unsigned char fMustAlloc)
{
  unsigned char *Mark = pStubMsg->BufferMark;
  unsigned rep, count, stride;
  unsigned i;
  unsigned char *saved_buffer = NULL;
 
  TRACE("(%p,%p,%p,%p,%d)\n", pStubMsg, pDstBuffer, pSrcMemoryPtrs, pFormat, fMustAlloc);
 
  if (*pFormat != FC_PP) return NULL;
  pFormat += 2;
 
  if (pStubMsg->PointerBufferMark)
  {
    saved_buffer = pStubMsg->Buffer;
    pStubMsg->Buffer = pStubMsg->PointerBufferMark;
    pStubMsg->PointerBufferMark = NULL;
  }
 
  while (pFormat[0] != FC_END) {
    TRACE("pFormat[0] = 0x%x\n", pFormat[0]);
    switch (pFormat[0]) {
    default:
      FIXME("unknown repeat type %d; assuming no repeat\n", pFormat[0]);
      /* fallthrough */
    case FC_NO_REPEAT:
      rep = 1;
      stride = 0;
      count = 1;
      pFormat += 2;
      break;
    case FC_FIXED_REPEAT:
      rep = *(const WORD*)&pFormat[2];
      stride = *(const WORD*)&pFormat[4];
      count = *(const WORD*)&pFormat[8];
      pFormat += 10;
      break;
    case FC_VARIABLE_REPEAT:
      rep = (pFormat[1] == FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
      stride = *(const WORD*)&pFormat[2];
      count = *(const WORD*)&pFormat[6];
      pFormat += 8;
      break;
    }
    for (i = 0; i < rep; i++) {
      PFORMAT_STRING info = pFormat;
      unsigned char *bufdstbase = pDstBuffer + (i * stride);
      unsigned char *memsrcbase = pSrcMemoryPtrs + (i * stride);
      unsigned char *bufbase = Mark + (i * stride);
      unsigned u;
 
      for (u=0; u<count; u++,info+=8) {
        unsigned char **bufdstptr = (unsigned char **)(bufdstbase + *(const SHORT*)&info[2]);
        unsigned char **memsrcptr = (unsigned char **)(memsrcbase + *(const SHORT*)&info[0]);
        unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
        PointerUnmarshall(pStubMsg, bufptr, bufdstptr, *memsrcptr, info+4, fMustAlloc);
      }
    }
    pFormat += 8 * count;
  }
 
  if (saved_buffer)
  {
    pStubMsg->PointerBufferMark = pStubMsg->Buffer;
    pStubMsg->Buffer = saved_buffer;
  }
 
  return NULL;
}
 
/***********************************************************************
 *           EmbeddedPointerBufferSize
 */
static void EmbeddedPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                      unsigned char *pMemory,
                                      PFORMAT_STRING pFormat)
{
  unsigned rep, count, stride;
  unsigned i;
  ULONG saved_buffer_length = 0;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  if (pStubMsg->IgnoreEmbeddedPointers) return;
 
  if (*pFormat != FC_PP) return;
  pFormat += 2;
 
  if (pStubMsg->PointerLength)
  {
    saved_buffer_length = pStubMsg->BufferLength;
    pStubMsg->BufferLength = pStubMsg->PointerLength;
    pStubMsg->PointerLength = 0;
  }
 
  while (pFormat[0] != FC_END) {
    switch (pFormat[0]) {
    default:
      FIXME("unknown repeat type %d; assuming no repeat\n", pFormat[0]);
      /* fallthrough */
    case FC_NO_REPEAT:
      rep = 1;
      stride = 0;
      count = 1;
      pFormat += 2;
      break;
    case FC_FIXED_REPEAT:
      rep = *(const WORD*)&pFormat[2];
      stride = *(const WORD*)&pFormat[4];
      count = *(const WORD*)&pFormat[8];
      pFormat += 10;
      break;
    case FC_VARIABLE_REPEAT:
      rep = (pFormat[1] == FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
      stride = *(const WORD*)&pFormat[2];
      count = *(const WORD*)&pFormat[6];
      pFormat += 8;
      break;
    }
    for (i = 0; i < rep; i++) {
      PFORMAT_STRING info = pFormat;
      unsigned char *membase = pMemory + (i * stride);
      unsigned u;
 
      for (u=0; u<count; u++,info+=8) {
        unsigned char *memptr = membase + *(const SHORT*)&info[0];
        unsigned char *saved_memory = pStubMsg->Memory;
 
        pStubMsg->Memory = membase;
        PointerBufferSize(pStubMsg, *(unsigned char**)memptr, info+4);
        pStubMsg->Memory = saved_memory;
      }
    }
    pFormat += 8 * count;
  }
 
  if (saved_buffer_length)
  {
    pStubMsg->PointerLength = pStubMsg->BufferLength;
    pStubMsg->BufferLength = saved_buffer_length;
  }
}
 
/***********************************************************************
 *           EmbeddedPointerMemorySize [internal]
 */
static ULONG EmbeddedPointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                       PFORMAT_STRING pFormat)
{
  unsigned char *Mark = pStubMsg->BufferMark;
  unsigned rep, count, stride;
  unsigned i;
  unsigned char *saved_buffer = NULL;
 
  TRACE("(%p,%p)\n", pStubMsg, pFormat);
 
  if (pStubMsg->IgnoreEmbeddedPointers) return 0;
 
  if (pStubMsg->PointerBufferMark)
  {
    saved_buffer = pStubMsg->Buffer;
    pStubMsg->Buffer = pStubMsg->PointerBufferMark;
    pStubMsg->PointerBufferMark = NULL;
  }
 
  if (*pFormat != FC_PP) return 0;
  pFormat += 2;
 
  while (pFormat[0] != FC_END) {
    switch (pFormat[0]) {
    default:
      FIXME("unknown repeat type %d; assuming no repeat\n", pFormat[0]);
      /* fallthrough */
    case FC_NO_REPEAT:
      rep = 1;
      stride = 0;
      count = 1;
      pFormat += 2;
      break;
    case FC_FIXED_REPEAT:
      rep = *(const WORD*)&pFormat[2];
      stride = *(const WORD*)&pFormat[4];
      count = *(const WORD*)&pFormat[8];
      pFormat += 10;
      break;
    case FC_VARIABLE_REPEAT:
      rep = (pFormat[1] == FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
      stride = *(const WORD*)&pFormat[2];
      count = *(const WORD*)&pFormat[6];
      pFormat += 8;
      break;
    }
    for (i = 0; i < rep; i++) {
      PFORMAT_STRING info = pFormat;
      unsigned char *bufbase = Mark + (i * stride);
      unsigned u;
      for (u=0; u<count; u++,info+=8) {
        unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
        PointerMemorySize(pStubMsg, bufptr, info+4);
      }
    }
    pFormat += 8 * count;
  }
 
  if (saved_buffer)
  {
    pStubMsg->PointerBufferMark = pStubMsg->Buffer;
    pStubMsg->Buffer = saved_buffer;
  }
 
  return 0;
}
 
/***********************************************************************
 *           EmbeddedPointerFree [internal]
 */
static void EmbeddedPointerFree(PMIDL_STUB_MESSAGE pStubMsg,
                                unsigned char *pMemory,
                                PFORMAT_STRING pFormat)
{
  unsigned rep, count, stride;
  unsigned i;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
  if (*pFormat != FC_PP) return;
  pFormat += 2;
 
  while (pFormat[0] != FC_END) {
    switch (pFormat[0]) {
    default:
      FIXME("unknown repeat type %d; assuming no repeat\n", pFormat[0]);
      /* fallthrough */
    case FC_NO_REPEAT:
      rep = 1;
      stride = 0;
      count = 1;
      pFormat += 2;
      break;
    case FC_FIXED_REPEAT:
      rep = *(const WORD*)&pFormat[2];
      stride = *(const WORD*)&pFormat[4];
      count = *(const WORD*)&pFormat[8];
      pFormat += 10;
      break;
    case FC_VARIABLE_REPEAT:
      rep = (pFormat[1] == FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
      stride = *(const WORD*)&pFormat[2];
      count = *(const WORD*)&pFormat[6];
      pFormat += 8;
      break;
    }
    for (i = 0; i < rep; i++) {
      PFORMAT_STRING info = pFormat;
      unsigned char *membase = pMemory + (i * stride);
      unsigned u;
 
      for (u=0; u<count; u++,info+=8) {
        unsigned char *memptr = membase + *(const SHORT*)&info[0];
        unsigned char *saved_memory = pStubMsg->Memory;
 
        pStubMsg->Memory = membase;
        PointerFree(pStubMsg, *(unsigned char**)memptr, info+4);
        pStubMsg->Memory = saved_memory;
      }
    }
    pFormat += 8 * count;
  }
}
 
/***********************************************************************
 *           NdrPointerMarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                          unsigned char *pMemory,
                                          PFORMAT_STRING pFormat)
{
  unsigned char *Buffer;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  /* Increment the buffer here instead of in PointerMarshall,
   * as that is used by embedded pointers which already handle the incrementing
   * the buffer, and shouldn't write any additional pointer data to the wire */
  if (*pFormat != FC_RP)
  {
    align_pointer_clear(&pStubMsg->Buffer, 4);
    Buffer = pStubMsg->Buffer;
    safe_buffer_increment(pStubMsg, 4);
  }
  else
    Buffer = pStubMsg->Buffer;
 
  PointerMarshall(pStubMsg, Buffer, pMemory, pFormat);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrPointerUnmarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrPointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                            unsigned char **ppMemory,
                                            PFORMAT_STRING pFormat,
                                            unsigned char fMustAlloc)
{
  unsigned char *Buffer;
 
  TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
 
  if (*pFormat == FC_RP)
  {
    Buffer = pStubMsg->Buffer;
    /* Do the NULL ref pointer check here because embedded pointers can be
     * NULL if the type the pointer is embedded in was allocated rather than
     * being passed in by the client */
    if (pStubMsg->IsClient && !*ppMemory)
    {
      ERR("NULL ref pointer is not allowed\n");
      RpcRaiseException(RPC_X_NULL_REF_POINTER);
    }
  }
  else
  {
    /* Increment the buffer here instead of in PointerUnmarshall,
     * as that is used by embedded pointers which already handle the incrementing
     * the buffer, and shouldn't read any additional pointer data from the
     * buffer */
    align_pointer(&pStubMsg->Buffer, 4);
    Buffer = pStubMsg->Buffer;
    safe_buffer_increment(pStubMsg, 4);
  }
 
  PointerUnmarshall(pStubMsg, Buffer, ppMemory, *ppMemory, pFormat, fMustAlloc);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrPointerBufferSize [RPCRT4.@]
 */
void WINAPI NdrPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                      unsigned char *pMemory,
                                      PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  /* Increment the buffer length here instead of in PointerBufferSize,
   * as that is used by embedded pointers which already handle the buffer
   * length, and shouldn't write anything more to the wire */
  if (*pFormat != FC_RP)
  {
    align_length(&pStubMsg->BufferLength, 4);
    safe_buffer_length_increment(pStubMsg, 4);
  }
 
  PointerBufferSize(pStubMsg, pMemory, pFormat);
}
 
/***********************************************************************
 *           NdrPointerMemorySize [RPCRT4.@]
 */
ULONG WINAPI NdrPointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                  PFORMAT_STRING pFormat)
{
    unsigned char *Buffer = pStubMsg->Buffer;
    if (*pFormat != FC_RP)
    {
        align_pointer(&pStubMsg->Buffer, 4);
        safe_buffer_increment(pStubMsg, 4);
    }
    align_length(&pStubMsg->MemorySize, sizeof(void *));
    return PointerMemorySize(pStubMsg, Buffer, pFormat);
}
 
/***********************************************************************
 *           NdrPointerFree [RPCRT4.@]
 */
void WINAPI NdrPointerFree(PMIDL_STUB_MESSAGE pStubMsg,
                           unsigned char *pMemory,
                           PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
  PointerFree(pStubMsg, pMemory, pFormat);
}
 
/***********************************************************************
 *           NdrSimpleTypeMarshall [RPCRT4.@]
 */
void WINAPI NdrSimpleTypeMarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory,
                                   unsigned char FormatChar )
{
    NdrBaseTypeMarshall(pStubMsg, pMemory, &FormatChar);
}
 
/***********************************************************************
 *           NdrSimpleTypeUnmarshall [RPCRT4.@]
 *
 * Unmarshall a base type.
 *
 * NOTES
 *  Doesn't check that the buffer is long enough before copying, so the caller
 * should do this.
 */
void WINAPI NdrSimpleTypeUnmarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory,
                                     unsigned char FormatChar )
{
#define BASE_TYPE_UNMARSHALL(type) \
        align_pointer(&pStubMsg->Buffer, sizeof(type)); \
    TRACE("pMemory: %p\n", pMemory); \
    *(type *)pMemory = *(type *)pStubMsg->Buffer; \
        pStubMsg->Buffer += sizeof(type);
 
    switch(FormatChar)
    {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
        BASE_TYPE_UNMARSHALL(UCHAR);
        TRACE("value: 0x%02x\n", *pMemory);
        break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
        BASE_TYPE_UNMARSHALL(USHORT);
        TRACE("value: 0x%04x\n", *(USHORT *)pMemory);
        break;
    case FC_LONG:
    case FC_ULONG:
    case FC_ERROR_STATUS_T:
    case FC_ENUM32:
        BASE_TYPE_UNMARSHALL(ULONG);
        TRACE("value: 0x%08x\n", *(ULONG *)pMemory);
        break;
   case FC_FLOAT:
        BASE_TYPE_UNMARSHALL(float);
        TRACE("value: %f\n", *(float *)pMemory);
        break;
    case FC_DOUBLE:
        BASE_TYPE_UNMARSHALL(double);
        TRACE("value: %f\n", *(double *)pMemory);
        break;
    case FC_HYPER:
        BASE_TYPE_UNMARSHALL(ULONGLONG);
        TRACE("value: %s\n", wine_dbgstr_longlong(*(ULONGLONG *)pMemory));
        break;
    case FC_ENUM16:
        align_pointer(&pStubMsg->Buffer, sizeof(USHORT));
        TRACE("pMemory: %p\n", pMemory);
        /* 16-bits on the wire, but int in memory */
        *(UINT *)pMemory = *(USHORT *)pStubMsg->Buffer;
        pStubMsg->Buffer += sizeof(USHORT);
        TRACE("value: 0x%08x\n", *(UINT *)pMemory);
        break;
    case FC_INT3264:
        align_pointer(&pStubMsg->Buffer, sizeof(INT));
        /* 32-bits on the wire, but int_ptr in memory */
        *(INT_PTR *)pMemory = *(INT *)pStubMsg->Buffer;
        pStubMsg->Buffer += sizeof(INT);
        TRACE("value: 0x%08lx\n", *(INT_PTR *)pMemory);
        break;
    case FC_UINT3264:
        align_pointer(&pStubMsg->Buffer, sizeof(UINT));
        /* 32-bits on the wire, but int_ptr in memory */
        *(UINT_PTR *)pMemory = *(UINT *)pStubMsg->Buffer;
        pStubMsg->Buffer += sizeof(UINT);
        TRACE("value: 0x%08lx\n", *(UINT_PTR *)pMemory);
        break;
    case FC_IGNORE:
        break;
    default:
        FIXME("Unhandled base type: 0x%02x\n", FormatChar);
    }
#undef BASE_TYPE_UNMARSHALL
}
 
/***********************************************************************
 *           NdrSimpleStructMarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrSimpleStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                               unsigned char *pMemory,
                                               PFORMAT_STRING pFormat)
{
  unsigned size = *(const WORD*)(pFormat+2);
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  align_pointer_clear(&pStubMsg->Buffer, pFormat[1] + 1);
 
  pStubMsg->BufferMark = pStubMsg->Buffer;
  safe_copy_to_buffer(pStubMsg, pMemory, size);
 
  if (pFormat[0] != FC_STRUCT)
    EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat+4);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrSimpleStructUnmarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrSimpleStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                                 unsigned char **ppMemory,
                                                 PFORMAT_STRING pFormat,
                                                 unsigned char fMustAlloc)
{
  unsigned size = *(const WORD*)(pFormat+2);
  unsigned char *saved_buffer;
  TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
 
  align_pointer(&pStubMsg->Buffer, pFormat[1] + 1);
 
  if (fMustAlloc)
    *ppMemory = NdrAllocateZero(pStubMsg, size);
  else
  {
    if (!pStubMsg->IsClient && !*ppMemory)
      /* for servers, we just point straight into the RPC buffer */
      *ppMemory = pStubMsg->Buffer;
  }
 
  saved_buffer = pStubMsg->BufferMark = pStubMsg->Buffer;
  safe_buffer_increment(pStubMsg, size);
  if (pFormat[0] == FC_PSTRUCT)
      EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat+4, fMustAlloc);
 
  TRACE("copying %p to %p\n", saved_buffer, *ppMemory);
  if (*ppMemory != saved_buffer)
      memcpy(*ppMemory, saved_buffer, size);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrSimpleStructBufferSize [RPCRT4.@]
 */
void WINAPI NdrSimpleStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                      unsigned char *pMemory,
                                      PFORMAT_STRING pFormat)
{
  unsigned size = *(const WORD*)(pFormat+2);
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  align_length(&pStubMsg->BufferLength, pFormat[1] + 1);
 
  safe_buffer_length_increment(pStubMsg, size);
  if (pFormat[0] != FC_STRUCT)
    EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat+4);
}
 
/***********************************************************************
 *           NdrSimpleStructMemorySize [RPCRT4.@]
 */
ULONG WINAPI NdrSimpleStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                       PFORMAT_STRING pFormat)
{
  unsigned short size = *(const WORD *)(pFormat+2);
 
  TRACE("(%p,%p)\n", pStubMsg, pFormat);
 
  align_pointer(&pStubMsg->Buffer, pFormat[1] + 1);
  pStubMsg->MemorySize += size;
  safe_buffer_increment(pStubMsg, size);
 
  if (pFormat[0] != FC_STRUCT)
    EmbeddedPointerMemorySize(pStubMsg, pFormat+4);
  return pStubMsg->MemorySize;
}
 
/***********************************************************************
 *           NdrSimpleStructFree [RPCRT4.@]
 */
void WINAPI NdrSimpleStructFree(PMIDL_STUB_MESSAGE pStubMsg,
                                unsigned char *pMemory,
                                PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
  if (pFormat[0] != FC_STRUCT)
    EmbeddedPointerFree(pStubMsg, pMemory, pFormat+4);
}
 
/* Array helpers */
 
static inline void array_compute_and_size_conformance(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
    PFORMAT_STRING pFormat)
{
  DWORD count;
 
  switch (fc)
  {
  case FC_CARRAY:
    ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
    SizeConformance(pStubMsg);
    break;
  case FC_CVARRAY:
    pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, 0);
    pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
    SizeConformance(pStubMsg);
    break;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
    {
      TRACE("string=%s\n", debugstr_a((const char *)pMemory));
      pStubMsg->ActualCount = strlen((const char *)pMemory)+1;
    }
    else
    {
      TRACE("string=%s\n", debugstr_w((LPCWSTR)pMemory));
      pStubMsg->ActualCount = lstrlenW((LPCWSTR)pMemory)+1;
    }
 
    if (pFormat[1] == FC_STRING_SIZED)
      pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0);
    else
      pStubMsg->MaxCount = pStubMsg->ActualCount;
 
    SizeConformance(pStubMsg);
    break;
  case FC_BOGUS_ARRAY:
    count = *(const WORD *)(pFormat + 2);
    pFormat += 4;
    if (IsConformanceOrVariancePresent(pFormat)) SizeConformance(pStubMsg);
    pFormat = ComputeConformance(pStubMsg, pMemory, pFormat, count);
    pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, pStubMsg->MaxCount);
    break;
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline void array_buffer_size(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
    PFORMAT_STRING pFormat, unsigned char fHasPointers)
{
  DWORD i, size;
  DWORD esize;
  unsigned char alignment;
 
  switch (fc)
  {
  case FC_CARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
 
    align_length(&pStubMsg->BufferLength, alignment);
 
    size = safe_multiply(esize, pStubMsg->MaxCount);
    /* conformance value plus array */
    safe_buffer_length_increment(pStubMsg, size);
 
    if (fHasPointers)
      EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat);
    break;
  case FC_CVARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
    pFormat = SkipVariance(pStubMsg, pFormat);
 
    SizeVariance(pStubMsg);
 
    align_length(&pStubMsg->BufferLength, alignment);
 
    size = safe_multiply(esize, pStubMsg->ActualCount);
    safe_buffer_length_increment(pStubMsg, size);
 
    if (fHasPointers)
      EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat);
    break;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
      esize = 1;
    else
      esize = 2;
 
    SizeVariance(pStubMsg);
 
    size = safe_multiply(esize, pStubMsg->ActualCount);
    safe_buffer_length_increment(pStubMsg, size);
    break;
  case FC_BOGUS_ARRAY:
    alignment = pFormat[1] + 1;
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
    if (IsConformanceOrVariancePresent(pFormat)) SizeVariance(pStubMsg);
    pFormat = SkipVariance(pStubMsg, pFormat);
 
    align_length(&pStubMsg->BufferLength, alignment);
 
    size = pStubMsg->ActualCount;
    for (i = 0; i < size; i++)
      pMemory = ComplexBufferSize(pStubMsg, pMemory, pFormat, NULL);
    break;
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline void array_compute_and_write_conformance(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
    PFORMAT_STRING pFormat)
{
  ULONG def;
  BOOL conformance_present;
 
  switch (fc)
  {
  case FC_CARRAY:
    ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
    WriteConformance(pStubMsg);
    break;
  case FC_CVARRAY:
    pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, 0);
    pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
    WriteConformance(pStubMsg);
    break;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
    {
      TRACE("string=%s\n", debugstr_a((const char *)pMemory));
      pStubMsg->ActualCount = strlen((const char *)pMemory)+1;
    }
    else
    {
      TRACE("string=%s\n", debugstr_w((LPCWSTR)pMemory));
      pStubMsg->ActualCount = lstrlenW((LPCWSTR)pMemory)+1;
    }
    if (pFormat[1] == FC_STRING_SIZED)
      pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0);
    else
      pStubMsg->MaxCount = pStubMsg->ActualCount;
    pStubMsg->Offset = 0;
    WriteConformance(pStubMsg);
    break;
  case FC_BOGUS_ARRAY:
    def = *(const WORD *)(pFormat + 2);
    pFormat += 4;
    conformance_present = IsConformanceOrVariancePresent(pFormat);
    pFormat = ComputeConformance(pStubMsg, pMemory, pFormat, def);
    pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, pStubMsg->MaxCount);
    if (conformance_present) WriteConformance(pStubMsg);
    break;
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline void array_write_variance_and_marshall(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
    PFORMAT_STRING pFormat, unsigned char fHasPointers)
{
  DWORD i, size;
  DWORD esize;
  unsigned char alignment;
 
  switch (fc)
  {
  case FC_CARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
 
    align_pointer_clear(&pStubMsg->Buffer, alignment);
 
    size = safe_multiply(esize, pStubMsg->MaxCount);
    if (fHasPointers)
      pStubMsg->BufferMark = pStubMsg->Buffer;
    safe_copy_to_buffer(pStubMsg, pMemory, size);
 
    if (fHasPointers)
      EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat);
    break;
  case FC_CVARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
    pFormat = SkipVariance(pStubMsg, pFormat);
 
    WriteVariance(pStubMsg);
 
    align_pointer_clear(&pStubMsg->Buffer, alignment);
 
    size = safe_multiply(esize, pStubMsg->ActualCount);
 
    if (fHasPointers)
      pStubMsg->BufferMark = pStubMsg->Buffer;
    safe_copy_to_buffer(pStubMsg, pMemory + pStubMsg->Offset, size);
 
    if (fHasPointers)
      EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat);
    break;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
      esize = 1;
    else
      esize = 2;
 
    WriteVariance(pStubMsg);
 
    size = safe_multiply(esize, pStubMsg->ActualCount);
    safe_copy_to_buffer(pStubMsg, pMemory, size); /* the string itself */
    break;
  case FC_BOGUS_ARRAY:
    alignment = pFormat[1] + 1;
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
    if (IsConformanceOrVariancePresent(pFormat)) WriteVariance(pStubMsg);
    pFormat = SkipVariance(pStubMsg, pFormat);
 
    align_pointer_clear(&pStubMsg->Buffer, alignment);
 
    size = pStubMsg->ActualCount;
    for (i = 0; i < size; i++)
      pMemory = ComplexMarshall(pStubMsg, pMemory, pFormat, NULL);
    break;
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline ULONG array_read_conformance(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
{
  DWORD def, esize;
 
  switch (fc)
  {
  case FC_CARRAY:
    esize = *(const WORD*)(pFormat+2);
    pFormat = ReadConformance(pStubMsg, pFormat+4);
    return safe_multiply(esize, pStubMsg->MaxCount);
  case FC_CVARRAY:
    esize = *(const WORD*)(pFormat+2);
    pFormat = ReadConformance(pStubMsg, pFormat+4);
    return safe_multiply(esize, pStubMsg->MaxCount);
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
      esize = 1;
    else
      esize = 2;
 
    if (pFormat[1] == FC_STRING_SIZED)
      ReadConformance(pStubMsg, pFormat + 2);
    else
      ReadConformance(pStubMsg, NULL);
    return safe_multiply(esize, pStubMsg->MaxCount);
  case FC_BOGUS_ARRAY:
    def = *(const WORD *)(pFormat + 2);
    pFormat += 4;
    if (IsConformanceOrVariancePresent(pFormat)) pFormat = ReadConformance(pStubMsg, pFormat);
    else
    {
        pStubMsg->MaxCount = def;
        pFormat = SkipConformance( pStubMsg, pFormat );
    }
    pFormat = SkipVariance( pStubMsg, pFormat );
 
    esize = ComplexStructSize(pStubMsg, pFormat);
    return safe_multiply(pStubMsg->MaxCount, esize);
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline ULONG array_read_variance_and_unmarshall(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char **ppMemory,
    PFORMAT_STRING pFormat, unsigned char fMustAlloc,
    unsigned char fUseBufferMemoryServer, unsigned char fUnmarshall)
{
  ULONG bufsize, memsize;
  WORD esize;
  unsigned char alignment;
  unsigned char *saved_buffer, *pMemory;
  ULONG i, offset, count;
 
  switch (fc)
  {
  case FC_CARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    bufsize = memsize = safe_multiply(esize, pStubMsg->MaxCount);
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
 
    align_pointer(&pStubMsg->Buffer, alignment);
 
    if (fUnmarshall)
    {
      if (fMustAlloc)
        *ppMemory = NdrAllocateZero(pStubMsg, memsize);
      else
      {
        if (fUseBufferMemoryServer && !pStubMsg->IsClient && !*ppMemory)
          /* for servers, we just point straight into the RPC buffer */
          *ppMemory = pStubMsg->Buffer;
      }
 
      saved_buffer = pStubMsg->Buffer;
      safe_buffer_increment(pStubMsg, bufsize);
 
      pStubMsg->BufferMark = saved_buffer;
      EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat, fMustAlloc);
 
      TRACE("copying %p to %p\n", saved_buffer, *ppMemory);
      if (*ppMemory != saved_buffer)
        memcpy(*ppMemory, saved_buffer, bufsize);
    }
    return bufsize;
  case FC_CVARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
 
    pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
 
    align_pointer(&pStubMsg->Buffer, alignment);
 
    bufsize = safe_multiply(esize, pStubMsg->ActualCount);
    memsize = safe_multiply(esize, pStubMsg->MaxCount);
 
    if (fUnmarshall)
    {
      offset = pStubMsg->Offset;
 
      if (!fMustAlloc && !*ppMemory)
        fMustAlloc = TRUE;
      if (fMustAlloc)
        *ppMemory = NdrAllocateZero(pStubMsg, memsize);
      saved_buffer = pStubMsg->Buffer;
      safe_buffer_increment(pStubMsg, bufsize);
 
      pStubMsg->BufferMark = saved_buffer;
      EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat,
                                fMustAlloc);
 
      memcpy(*ppMemory + offset, saved_buffer, bufsize);
    }
    return bufsize;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
      esize = 1;
    else
      esize = 2;
 
    ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount);
 
    if (pFormat[1] != FC_STRING_SIZED && (pStubMsg->MaxCount != pStubMsg->ActualCount))
    {
      ERR("buffer size %d must equal memory size %ld for non-sized conformant strings\n",
          pStubMsg->ActualCount, pStubMsg->MaxCount);
      RpcRaiseException(RPC_S_INVALID_BOUND);
    }
    if (pStubMsg->Offset)
    {
      ERR("conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
      RpcRaiseException(RPC_S_INVALID_BOUND);
    }
 
    memsize = safe_multiply(esize, pStubMsg->MaxCount);
    bufsize = safe_multiply(esize, pStubMsg->ActualCount);
 
    validate_string_data(pStubMsg, bufsize, esize);
 
    if (fUnmarshall)
    {
      if (fMustAlloc)
        *ppMemory = NdrAllocate(pStubMsg, memsize);
      else
      {
        if (fUseBufferMemoryServer && !pStubMsg->IsClient &&
            !*ppMemory && (pStubMsg->MaxCount == pStubMsg->ActualCount))
          /* if the data in the RPC buffer is big enough, we just point
           * straight into it */
          *ppMemory = pStubMsg->Buffer;
        else if (!*ppMemory)
          *ppMemory = NdrAllocate(pStubMsg, memsize);
      }
 
      if (*ppMemory == pStubMsg->Buffer)
        safe_buffer_increment(pStubMsg, bufsize);
      else
        safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);
 
      if (*pFormat == FC_C_CSTRING)
        TRACE("string=%s\n", debugstr_a((char*)*ppMemory));
      else
        TRACE("string=%s\n", debugstr_w((LPWSTR)*ppMemory));
    }
    return bufsize;
 
  case FC_BOGUS_ARRAY:
    alignment = pFormat[1] + 1;
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
    pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
 
    esize = ComplexStructSize(pStubMsg, pFormat);
    memsize = safe_multiply(esize, pStubMsg->MaxCount);
 
    assert( fUnmarshall );
 
    if (!fMustAlloc && !*ppMemory)
      fMustAlloc = TRUE;
    if (fMustAlloc)
      *ppMemory = NdrAllocateZero(pStubMsg, memsize);
 
    align_pointer(&pStubMsg->Buffer, alignment);
    saved_buffer = pStubMsg->Buffer;
 
    pMemory = *ppMemory;
    count = pStubMsg->ActualCount;
    for (i = 0; i < count; i++)
        pMemory = ComplexUnmarshall(pStubMsg, pMemory, pFormat, NULL, fMustAlloc);
    return pStubMsg->Buffer - saved_buffer;
 
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline void array_memory_size(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat,
    unsigned char fHasPointers)
{
  ULONG i, count, SavedMemorySize;
  ULONG bufsize, memsize;
  DWORD esize;
  unsigned char alignment;
 
  switch (fc)
  {
  case FC_CARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
 
    bufsize = memsize = safe_multiply(esize, pStubMsg->MaxCount);
    pStubMsg->MemorySize += memsize;
 
    align_pointer(&pStubMsg->Buffer, alignment);
    if (fHasPointers)
      pStubMsg->BufferMark = pStubMsg->Buffer;
    safe_buffer_increment(pStubMsg, bufsize);
 
    if (fHasPointers)
      EmbeddedPointerMemorySize(pStubMsg, pFormat);
    break;
  case FC_CVARRAY:
    esize = *(const WORD*)(pFormat+2);
    alignment = pFormat[1] + 1;
 
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
 
    pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
 
    bufsize = safe_multiply(esize, pStubMsg->ActualCount);
    memsize = safe_multiply(esize, pStubMsg->MaxCount);
    pStubMsg->MemorySize += memsize;
 
    align_pointer(&pStubMsg->Buffer, alignment);
    if (fHasPointers)
      pStubMsg->BufferMark = pStubMsg->Buffer;
    safe_buffer_increment(pStubMsg, bufsize);
 
    if (fHasPointers)
      EmbeddedPointerMemorySize(pStubMsg, pFormat);
    break;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    if (fc == FC_C_CSTRING)
      esize = 1;
    else
      esize = 2;
 
    ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount);
 
    if (pFormat[1] != FC_STRING_SIZED && (pStubMsg->MaxCount != pStubMsg->ActualCount))
    {
      ERR("buffer size %d must equal memory size %ld for non-sized conformant strings\n",
          pStubMsg->ActualCount, pStubMsg->MaxCount);
      RpcRaiseException(RPC_S_INVALID_BOUND);
    }
    if (pStubMsg->Offset)
    {
      ERR("conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
      RpcRaiseException(RPC_S_INVALID_BOUND);
    }
 
    memsize = safe_multiply(esize, pStubMsg->MaxCount);
    bufsize = safe_multiply(esize, pStubMsg->ActualCount);
 
    validate_string_data(pStubMsg, bufsize, esize);
 
    safe_buffer_increment(pStubMsg, bufsize);
    pStubMsg->MemorySize += memsize;
    break;
  case FC_BOGUS_ARRAY:
    alignment = pFormat[1] + 1;
    pFormat = SkipConformance(pStubMsg, pFormat + 4);
    pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
 
    align_pointer(&pStubMsg->Buffer, alignment);
 
    SavedMemorySize = pStubMsg->MemorySize;
 
    esize = ComplexStructSize(pStubMsg, pFormat);
    memsize = safe_multiply(pStubMsg->MaxCount, esize);
 
    count = pStubMsg->ActualCount;
    for (i = 0; i < count; i++)
        ComplexStructMemorySize(pStubMsg, pFormat, NULL);
 
    pStubMsg->MemorySize = SavedMemorySize + memsize;
    break;
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
static inline void array_free(
    unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg,
    unsigned char *pMemory, PFORMAT_STRING pFormat, unsigned char fHasPointers)
{
  DWORD i, count;
 
  switch (fc)
  {
  case FC_CARRAY:
    pFormat = ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
    if (fHasPointers)
      EmbeddedPointerFree(pStubMsg, pMemory, pFormat);
    break;
  case FC_CVARRAY:
    pFormat = ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
    pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
    if (fHasPointers)
      EmbeddedPointerFree(pStubMsg, pMemory, pFormat);
    break;
  case FC_C_CSTRING:
  case FC_C_WSTRING:
    /* No embedded pointers so nothing to do */
    break;
  case FC_BOGUS_ARRAY:
      count = *(const WORD *)(pFormat + 2);
      pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, count);
      pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, pStubMsg->MaxCount);
 
      count = pStubMsg->ActualCount;
      for (i = 0; i < count; i++)
          pMemory = ComplexFree(pStubMsg, pMemory, pFormat, NULL);
    break;
  default:
    ERR("unknown array format 0x%x\n", fc);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
}
 
/*
 * NdrConformantString:
 *
 * What MS calls a ConformantString is, in DCE terminology,
 * a Varying-Conformant String.
 * [
 *   maxlen: DWORD (max # of CHARTYPE characters, inclusive of '\0')
 *   offset: DWORD (actual string data begins at (offset) CHARTYPE's
 *           into unmarshalled string)
 *   length: DWORD (# of CHARTYPE characters, inclusive of '\0')
 *   [
 *     data: CHARTYPE[maxlen]
 *   ]
 * ], where CHARTYPE is the appropriate character type (specified externally)
 *
 */
 
/***********************************************************************
 *            NdrConformantStringMarshall [RPCRT4.@]
 */
unsigned char *WINAPI NdrConformantStringMarshall(MIDL_STUB_MESSAGE *pStubMsg,
  unsigned char *pszMessage, PFORMAT_STRING pFormat)
{
  TRACE("(pStubMsg == ^%p, pszMessage == ^%p, pFormat == ^%p)\n", pStubMsg, pszMessage, pFormat);
 
  if (pFormat[0] != FC_C_CSTRING && pFormat[0] != FC_C_WSTRING) {
    ERR("Unhandled string type: %#x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  /* allow compiler to optimise inline function by passing constant into
   * these functions */
  if (pFormat[0] == FC_C_CSTRING) {
    array_compute_and_write_conformance(FC_C_CSTRING, pStubMsg, pszMessage,
                                        pFormat);
    array_write_variance_and_marshall(FC_C_CSTRING, pStubMsg, pszMessage,
                                      pFormat, TRUE /* fHasPointers */);
  } else {
    array_compute_and_write_conformance(FC_C_WSTRING, pStubMsg, pszMessage,
                                        pFormat);
    array_write_variance_and_marshall(FC_C_WSTRING, pStubMsg, pszMessage,
                                      pFormat, TRUE /* fHasPointers */);
  }
 
  return NULL;
}
 
/***********************************************************************
 *           NdrConformantStringBufferSize [RPCRT4.@]
 */
void WINAPI NdrConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
  unsigned char* pMemory, PFORMAT_STRING pFormat)
{
  TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
 
  if (pFormat[0] != FC_C_CSTRING && pFormat[0] != FC_C_WSTRING) {
    ERR("Unhandled string type: %#x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  /* allow compiler to optimise inline function by passing constant into
   * these functions */
  if (pFormat[0] == FC_C_CSTRING) {
    array_compute_and_size_conformance(FC_C_CSTRING, pStubMsg, pMemory,
                                       pFormat);
    array_buffer_size(FC_C_CSTRING, pStubMsg, pMemory, pFormat,
                      TRUE /* fHasPointers */);
  } else {
    array_compute_and_size_conformance(FC_C_WSTRING, pStubMsg, pMemory,
                                       pFormat);
    array_buffer_size(FC_C_WSTRING, pStubMsg, pMemory, pFormat,
                      TRUE /* fHasPointers */);
  }
}
 
/************************************************************************
 *            NdrConformantStringMemorySize [RPCRT4.@]
 */
ULONG WINAPI NdrConformantStringMemorySize( PMIDL_STUB_MESSAGE pStubMsg,
  PFORMAT_STRING pFormat )
{
  TRACE("(pStubMsg == ^%p, pFormat == ^%p)\n", pStubMsg, pFormat);
 
  if (pFormat[0] != FC_C_CSTRING && pFormat[0] != FC_C_WSTRING) {
    ERR("Unhandled string type: %#x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  /* allow compiler to optimise inline function by passing constant into
   * these functions */
  if (pFormat[0] == FC_C_CSTRING) {
    array_read_conformance(FC_C_CSTRING, pStubMsg, pFormat);
    array_memory_size(FC_C_CSTRING, pStubMsg, pFormat,
                      TRUE /* fHasPointers */);
  } else {
    array_read_conformance(FC_C_WSTRING, pStubMsg, pFormat);
    array_memory_size(FC_C_WSTRING, pStubMsg, pFormat,
                      TRUE /* fHasPointers */);
  }
 
  return pStubMsg->MemorySize;
}
 
/************************************************************************
 *           NdrConformantStringUnmarshall [RPCRT4.@]
 */
unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg,
  unsigned char** ppMemory, PFORMAT_STRING pFormat, unsigned char fMustAlloc )
{
  TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n",
    pStubMsg, *ppMemory, pFormat, fMustAlloc);
 
  if (pFormat[0] != FC_C_CSTRING && pFormat[0] != FC_C_WSTRING) {
    ERR("Unhandled string type: %#x\n", *pFormat);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  /* allow compiler to optimise inline function by passing constant into
   * these functions */
  if (pFormat[0] == FC_C_CSTRING) {
    array_read_conformance(FC_C_CSTRING, pStubMsg, pFormat);
    array_read_variance_and_unmarshall(FC_C_CSTRING, pStubMsg, ppMemory,
                                       pFormat, fMustAlloc,
                                       TRUE /* fUseBufferMemoryServer */,
                                       TRUE /* fUnmarshall */);
  } else {
    array_read_conformance(FC_C_WSTRING, pStubMsg, pFormat);
    array_read_variance_and_unmarshall(FC_C_WSTRING, pStubMsg, ppMemory,
                                       pFormat, fMustAlloc,
                                       TRUE /* fUseBufferMemoryServer */,
                                       TRUE /* fUnmarshall */);
  }
 
  return NULL;
}
 
/***********************************************************************
 *           NdrNonConformantStringMarshall [RPCRT4.@]
 */
unsigned char *  WINAPI NdrNonConformantStringMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                unsigned char *pMemory,
                                PFORMAT_STRING pFormat)
{
  ULONG esize, size, maxsize;
 
  TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
 
  maxsize = *(const USHORT *)&pFormat[2];
 
  if (*pFormat == FC_CSTRING)
  {
    ULONG i = 0;
    const char *str = (const char *)pMemory;
    while (i < maxsize && str[i]) i++;
    TRACE("string=%s\n", debugstr_an(str, i));
    pStubMsg->ActualCount = i + 1;
    esize = 1;
  }
  else if (*pFormat == FC_WSTRING)
  {
    ULONG i = 0;
    const WCHAR *str = (const WCHAR *)pMemory;
    while (i < maxsize && str[i]) i++;
    TRACE("string=%s\n", debugstr_wn(str, i));
    pStubMsg->ActualCount = i + 1;
    esize = 2;
  }
  else
  {
    ERR("Unhandled string type: %#x\n", *pFormat);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  pStubMsg->Offset = 0;
  WriteVariance(pStubMsg);
 
  size = safe_multiply(esize, pStubMsg->ActualCount);
  safe_copy_to_buffer(pStubMsg, pMemory, size); /* the string itself */
 
  return NULL;
}
 
/***********************************************************************
 *           NdrNonConformantStringUnmarshall [RPCRT4.@]
 */
unsigned char *  WINAPI NdrNonConformantStringUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                unsigned char **ppMemory,
                                PFORMAT_STRING pFormat,
                                unsigned char fMustAlloc)
{
  ULONG bufsize, memsize, esize, maxsize;
 
  TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n",
    pStubMsg, *ppMemory, pFormat, fMustAlloc);
 
  maxsize = *(const USHORT *)&pFormat[2];
 
  ReadVariance(pStubMsg, NULL, maxsize);
  if (pStubMsg->Offset)
  {
    ERR("non-conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
    RpcRaiseException(RPC_S_INVALID_BOUND);
  }
 
  if (*pFormat == FC_CSTRING) esize = 1;
  else if (*pFormat == FC_WSTRING) esize = 2;
  else
  {
    ERR("Unhandled string type: %#x\n", *pFormat);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  memsize = esize * maxsize;
  bufsize = safe_multiply(esize, pStubMsg->ActualCount);
 
  validate_string_data(pStubMsg, bufsize, esize);
 
  if (!fMustAlloc && !*ppMemory)
    fMustAlloc = TRUE;
  if (fMustAlloc)
    *ppMemory = NdrAllocate(pStubMsg, memsize);
 
  safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);
 
  if (*pFormat == FC_CSTRING) {
    TRACE("string=%s\n", debugstr_an((char*)*ppMemory, pStubMsg->ActualCount));
  }
  else if (*pFormat == FC_WSTRING) {
    TRACE("string=%s\n", debugstr_wn((LPWSTR)*ppMemory, pStubMsg->ActualCount));
  }
 
  return NULL;
}
 
/***********************************************************************
 *           NdrNonConformantStringBufferSize [RPCRT4.@]
 */
void WINAPI NdrNonConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                unsigned char *pMemory,
                                PFORMAT_STRING pFormat)
{
  ULONG esize, maxsize;
 
  TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
 
  maxsize = *(const USHORT *)&pFormat[2];
 
  SizeVariance(pStubMsg);
 
  if (*pFormat == FC_CSTRING)
  {
    ULONG i = 0;
    const char *str = (const char *)pMemory;
    while (i < maxsize && str[i]) i++;
    TRACE("string=%s\n", debugstr_an(str, i));
    pStubMsg->ActualCount = i + 1;
    esize = 1;
  }
  else if (*pFormat == FC_WSTRING)
  {
    ULONG i = 0;
    const WCHAR *str = (const WCHAR *)pMemory;
    while (i < maxsize && str[i]) i++;
    TRACE("string=%s\n", debugstr_wn(str, i));
    pStubMsg->ActualCount = i + 1;
    esize = 2;
  }
  else
  {
    ERR("Unhandled string type: %#x\n", *pFormat);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  safe_buffer_length_increment(pStubMsg, safe_multiply(esize, pStubMsg->ActualCount));
}
 
/***********************************************************************
 *           NdrNonConformantStringMemorySize [RPCRT4.@]
 */
ULONG WINAPI NdrNonConformantStringMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                PFORMAT_STRING pFormat)
{
  ULONG bufsize, memsize, esize, maxsize;
 
  TRACE("(pStubMsg == ^%p, pFormat == ^%p)\n", pStubMsg, pFormat);
 
  maxsize = *(const USHORT *)&pFormat[2];
 
  ReadVariance(pStubMsg, NULL, maxsize);
 
  if (pStubMsg->Offset)
  {
    ERR("non-conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
    RpcRaiseException(RPC_S_INVALID_BOUND);
  }
 
  if (*pFormat == FC_CSTRING) esize = 1;
  else if (*pFormat == FC_WSTRING) esize = 2;
  else
  {
    ERR("Unhandled string type: %#x\n", *pFormat);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  memsize = esize * maxsize;
  bufsize = safe_multiply(esize, pStubMsg->ActualCount);
 
  validate_string_data(pStubMsg, bufsize, esize);
 
  safe_buffer_increment(pStubMsg, bufsize);
  pStubMsg->MemorySize += memsize;
 
  return pStubMsg->MemorySize;
}
 
/* Complex types */
 
#include "pshpack1.h"
typedef struct
{
    unsigned char type;
    unsigned char flags_type; /* flags in upper nibble, type in lower nibble */
    ULONG low_value;
    ULONG high_value;
} NDR_RANGE;
#include "poppack.h"
 
static ULONG EmbeddedComplexSize(MIDL_STUB_MESSAGE *pStubMsg,
                                 PFORMAT_STRING pFormat)
{
  switch (*pFormat) {
  case FC_STRUCT:
  case FC_PSTRUCT:
  case FC_CSTRUCT:
  case FC_BOGUS_STRUCT:
  case FC_SMFARRAY:
  case FC_SMVARRAY:
  case FC_CSTRING:
    return *(const WORD*)&pFormat[2];
  case FC_LGFARRAY:
  case FC_LGVARRAY:
    return *(const ULONG*)&pFormat[2];
  case FC_USER_MARSHAL:
    return *(const WORD*)&pFormat[4];
  case FC_RANGE: {
    switch (((const NDR_RANGE *)pFormat)->flags_type & 0xf) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
        return sizeof(UCHAR);
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
        return sizeof(USHORT);
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM32:
        return sizeof(ULONG);
    case FC_FLOAT:
        return sizeof(float);
    case FC_DOUBLE:
        return sizeof(double);
    case FC_HYPER:
        return sizeof(ULONGLONG);
    case FC_ENUM16:
        return sizeof(UINT);
    default:
        ERR("unknown type 0x%x\n", ((const NDR_RANGE *)pFormat)->flags_type & 0xf);
        RpcRaiseException(RPC_X_BAD_STUB_DATA);
    }
  }
  case FC_NON_ENCAPSULATED_UNION:
    pFormat += 2;
    pFormat = SkipConformance(pStubMsg, pFormat);
    pFormat += *(const SHORT*)pFormat;
    return *(const SHORT*)pFormat;
  case FC_IP:
    return sizeof(void *);
  case FC_WSTRING:
    return *(const WORD*)&pFormat[2] * 2;
  default:
    FIXME("unhandled embedded type %02x\n", *pFormat);
  }
  return 0;
}
 
 
static ULONG EmbeddedComplexMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                       PFORMAT_STRING pFormat)
{
  NDR_MEMORYSIZE m = NdrMemorySizer[*pFormat & NDR_TABLE_MASK];
 
  if (!m)
  {
    FIXME("no memorysizer for data type=%02x\n", *pFormat);
    return 0;
  }
 
  return m(pStubMsg, pFormat);
}
 
 
static unsigned char * ComplexMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                       unsigned char *pMemory,
                                       PFORMAT_STRING pFormat,
                                       PFORMAT_STRING pPointer)
{
  unsigned char *mem_base = pMemory;
  PFORMAT_STRING desc;
  NDR_MARSHALL m;
  ULONG size;
 
  while (*pFormat != FC_END) {
    switch (*pFormat) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
      TRACE("byte=%d <= %p\n", *(WORD*)pMemory, pMemory);
      safe_copy_to_buffer(pStubMsg, pMemory, 1);
      pMemory += 1;
      break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
      TRACE("short=%d <= %p\n", *(WORD*)pMemory, pMemory);
      safe_copy_to_buffer(pStubMsg, pMemory, 2);
      pMemory += 2;
      break;
    case FC_ENUM16:
    {
      USHORT val = *(DWORD *)pMemory;
      TRACE("enum16=%d <= %p\n", *(DWORD*)pMemory, pMemory);
      if (32767 < *(DWORD*)pMemory)
        RpcRaiseException(RPC_X_ENUM_VALUE_OUT_OF_RANGE);
      safe_copy_to_buffer(pStubMsg, &val, 2);
      pMemory += 4;
      break;
    }
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM32:
      TRACE("long=%d <= %p\n", *(DWORD*)pMemory, pMemory);
      safe_copy_to_buffer(pStubMsg, pMemory, 4);
      pMemory += 4;
      break;
    case FC_INT3264:
    case FC_UINT3264:
    {
      UINT val = *(UINT_PTR *)pMemory;
      TRACE("int3264=%ld <= %p\n", *(UINT_PTR *)pMemory, pMemory);
      safe_copy_to_buffer(pStubMsg, &val, sizeof(UINT));
      pMemory += sizeof(UINT_PTR);
      break;
    }
    case FC_FLOAT:
      TRACE("float=%f <= %p\n", *(float*)pMemory, pMemory);
      safe_copy_to_buffer(pStubMsg, pMemory, sizeof(float));
      pMemory += sizeof(float);
      break;
    case FC_HYPER:
      TRACE("longlong=%s <= %p\n", wine_dbgstr_longlong(*(ULONGLONG*)pMemory), pMemory);
      safe_copy_to_buffer(pStubMsg, pMemory, 8);
      pMemory += 8;
      break;
    case FC_DOUBLE:
      TRACE("double=%f <= %p\n", *(double*)pMemory, pMemory);
      safe_copy_to_buffer(pStubMsg, pMemory, sizeof(double));
      pMemory += sizeof(double);
      break;
    case FC_RP:
    case FC_UP:
    case FC_OP:
    case FC_FP:
    case FC_POINTER:
    {
      unsigned char *saved_buffer;
      BOOL pointer_buffer_mark_set = FALSE;
      TRACE("pointer=%p <= %p\n", *(unsigned char**)pMemory, pMemory);
      TRACE("pStubMsg->Buffer before %p\n", pStubMsg->Buffer);
      if (*pFormat != FC_POINTER)
        pPointer = pFormat;
      if (*pPointer != FC_RP)
        align_pointer_clear(&pStubMsg->Buffer, 4);
      saved_buffer = pStubMsg->Buffer;
      if (pStubMsg->PointerBufferMark)
      {
        pStubMsg->Buffer = pStubMsg->PointerBufferMark;
        pStubMsg->PointerBufferMark = NULL;
        pointer_buffer_mark_set = TRUE;
      }
      else if (*pPointer != FC_RP)
        safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
      PointerMarshall(pStubMsg, saved_buffer, *(unsigned char**)pMemory, pPointer);
      if (pointer_buffer_mark_set)
      {
        STD_OVERFLOW_CHECK(pStubMsg);
        pStubMsg->PointerBufferMark = pStubMsg->Buffer;
        pStubMsg->Buffer = saved_buffer;
        if (*pPointer != FC_RP)
          safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
      }
      TRACE("pStubMsg->Buffer after %p\n", pStubMsg->Buffer);
      if (*pFormat == FC_POINTER)
        pPointer += 4;
      else
        pFormat += 4;
      pMemory += sizeof(void *);
      break;
    }
    case FC_ALIGNM2:
      align_pointer_offset(&pMemory, mem_base, 2);
      break;
    case FC_ALIGNM4:
      align_pointer_offset(&pMemory, mem_base, 4);
      break;
    case FC_ALIGNM8:
      align_pointer_offset(&pMemory, mem_base, 8);
      break;
    case FC_STRUCTPAD1:
    case FC_STRUCTPAD2:
    case FC_STRUCTPAD3:
    case FC_STRUCTPAD4:
    case FC_STRUCTPAD5:
    case FC_STRUCTPAD6:
    case FC_STRUCTPAD7:
      pMemory += *pFormat - FC_STRUCTPAD1 + 1;
      break;
    case FC_EMBEDDED_COMPLEX:
      pMemory += pFormat[1];
      pFormat += 2;
      desc = pFormat + *(const SHORT*)pFormat;
      size = EmbeddedComplexSize(pStubMsg, desc);
      TRACE("embedded complex (size=%d) <= %p\n", size, pMemory);
      m = NdrMarshaller[*desc & NDR_TABLE_MASK];
      if (m)
      {
        /* for some reason interface pointers aren't generated as
         * FC_POINTER, but instead as FC_EMBEDDED_COMPLEX, yet
         * they still need the dereferencing treatment that pointers are
         * given */
        if (*desc == FC_IP)
          m(pStubMsg, *(unsigned char **)pMemory, desc);
        else
          m(pStubMsg, pMemory, desc);
      }
      else FIXME("no marshaller for embedded type %02x\n", *desc);
      pMemory += size;
      pFormat += 2;
      continue;
    case FC_PAD:
      break;
    default:
      FIXME("unhandled format 0x%02x\n", *pFormat);
    }
    pFormat++;
  }
 
  return pMemory;
}
 
static unsigned char * ComplexUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                         unsigned char *pMemory,
                                         PFORMAT_STRING pFormat,
                                         PFORMAT_STRING pPointer,
                                         unsigned char fMustAlloc)
{
  unsigned char *mem_base = pMemory;
  PFORMAT_STRING desc;
  NDR_UNMARSHALL m;
  ULONG size;
 
  while (*pFormat != FC_END) {
    switch (*pFormat) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
      safe_copy_from_buffer(pStubMsg, pMemory, 1);
      TRACE("byte=%d => %p\n", *(WORD*)pMemory, pMemory);
      pMemory += 1;
      break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
      safe_copy_from_buffer(pStubMsg, pMemory, 2);
      TRACE("short=%d => %p\n", *(WORD*)pMemory, pMemory);
      pMemory += 2;
      break;
    case FC_ENUM16:
    {
      WORD val;
      safe_copy_from_buffer(pStubMsg, &val, 2);
      *(DWORD*)pMemory = val;
      TRACE("enum16=%d => %p\n", *(DWORD*)pMemory, pMemory);
      if (32767 < *(DWORD*)pMemory)
        RpcRaiseException(RPC_X_ENUM_VALUE_OUT_OF_RANGE);
      pMemory += 4;
      break;
    }
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM32:
      safe_copy_from_buffer(pStubMsg, pMemory, 4);
      TRACE("long=%d => %p\n", *(DWORD*)pMemory, pMemory);
      pMemory += 4;
      break;
    case FC_INT3264:
    {
      INT val;
      safe_copy_from_buffer(pStubMsg, &val, 4);
      *(INT_PTR *)pMemory = val;
      TRACE("int3264=%ld => %p\n", *(INT_PTR*)pMemory, pMemory);
      pMemory += sizeof(INT_PTR);
      break;
    }
    case FC_UINT3264:
    {
      UINT val;
      safe_copy_from_buffer(pStubMsg, &val, 4);
      *(UINT_PTR *)pMemory = val;
      TRACE("uint3264=%ld => %p\n", *(UINT_PTR*)pMemory, pMemory);
      pMemory += sizeof(UINT_PTR);
      break;
    }
    case FC_FLOAT:
      safe_copy_from_buffer(pStubMsg, pMemory, sizeof(float));
      TRACE("float=%f => %p\n", *(float*)pMemory, pMemory);
      pMemory += sizeof(float);
      break;
    case FC_HYPER:
      safe_copy_from_buffer(pStubMsg, pMemory, 8);
      TRACE("longlong=%s => %p\n", wine_dbgstr_longlong(*(ULONGLONG*)pMemory), pMemory);
      pMemory += 8;
      break;
    case FC_DOUBLE:
      safe_copy_from_buffer(pStubMsg, pMemory, sizeof(double));
      TRACE("double=%f => %p\n", *(double*)pMemory, pMemory);
      pMemory += sizeof(double);
      break;
    case FC_RP:
    case FC_UP:
    case FC_OP:
    case FC_FP:
    case FC_POINTER:
    {
      unsigned char *saved_buffer;
      BOOL pointer_buffer_mark_set = FALSE;
      TRACE("pointer => %p\n", pMemory);
      if (*pFormat != FC_POINTER)
        pPointer = pFormat;
      if (*pPointer != FC_RP)
        align_pointer(&pStubMsg->Buffer, 4);
      saved_buffer = pStubMsg->Buffer;
      if (pStubMsg->PointerBufferMark)
      {
        pStubMsg->Buffer = pStubMsg->PointerBufferMark;
        pStubMsg->PointerBufferMark = NULL;
        pointer_buffer_mark_set = TRUE;
      }
      else if (*pPointer != FC_RP)
        safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
 
      PointerUnmarshall(pStubMsg, saved_buffer, (unsigned char**)pMemory, *(unsigned char**)pMemory, pPointer, fMustAlloc);
      if (pointer_buffer_mark_set)
      {
        STD_OVERFLOW_CHECK(pStubMsg);
        pStubMsg->PointerBufferMark = pStubMsg->Buffer;
        pStubMsg->Buffer = saved_buffer;
        if (*pPointer != FC_RP)
          safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
      }
      if (*pFormat == FC_POINTER)
        pPointer += 4;
      else
        pFormat += 4;
      pMemory += sizeof(void *);
      break;
    }
    case FC_ALIGNM2:
      align_pointer_offset_clear(&pMemory, mem_base, 2);
      break;
    case FC_ALIGNM4:
      align_pointer_offset_clear(&pMemory, mem_base, 4);
      break;
    case FC_ALIGNM8:
      align_pointer_offset_clear(&pMemory, mem_base, 8);
      break;
    case FC_STRUCTPAD1:
    case FC_STRUCTPAD2:
    case FC_STRUCTPAD3:
    case FC_STRUCTPAD4:
    case FC_STRUCTPAD5:
    case FC_STRUCTPAD6:
    case FC_STRUCTPAD7:
      memset(pMemory, 0, *pFormat - FC_STRUCTPAD1 + 1);
      pMemory += *pFormat - FC_STRUCTPAD1 + 1;
      break;
    case FC_EMBEDDED_COMPLEX:
      pMemory += pFormat[1];
      pFormat += 2;
      desc = pFormat + *(const SHORT*)pFormat;
      size = EmbeddedComplexSize(pStubMsg, desc);
      TRACE("embedded complex (size=%d) => %p\n", size, pMemory);
      if (fMustAlloc)
        /* we can't pass fMustAlloc=TRUE into the marshaller for this type
         * since the type is part of the memory block that is encompassed by
         * the whole complex type. Memory is forced to allocate when pointers
         * are set to NULL, so we emulate that part of fMustAlloc=TRUE by
         * clearing the memory we pass in to the unmarshaller */
        memset(pMemory, 0, size);
      m = NdrUnmarshaller[*desc & NDR_TABLE_MASK];
      if (m)
      {
        /* for some reason interface pointers aren't generated as
         * FC_POINTER, but instead as FC_EMBEDDED_COMPLEX, yet
         * they still need the dereferencing treatment that pointers are
         * given */
        if (*desc == FC_IP)
          m(pStubMsg, (unsigned char **)pMemory, desc, FALSE);
        else
          m(pStubMsg, &pMemory, desc, FALSE);
      }
      else FIXME("no unmarshaller for embedded type %02x\n", *desc);
      pMemory += size;
      pFormat += 2;
      continue;
    case FC_PAD:
      break;
    default:
      FIXME("unhandled format %d\n", *pFormat);
    }
    pFormat++;
  }
 
  return pMemory;
}
 
static unsigned char * ComplexBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                         unsigned char *pMemory,
                                         PFORMAT_STRING pFormat,
                                         PFORMAT_STRING pPointer)
{
  unsigned char *mem_base = pMemory;
  PFORMAT_STRING desc;
  NDR_BUFFERSIZE m;
  ULONG size;
 
  while (*pFormat != FC_END) {
    switch (*pFormat) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
      safe_buffer_length_increment(pStubMsg, 1);
      pMemory += 1;
      break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
      safe_buffer_length_increment(pStubMsg, 2);
      pMemory += 2;
      break;
    case FC_ENUM16:
      safe_buffer_length_increment(pStubMsg, 2);
      pMemory += 4;
      break;
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM32:
    case FC_FLOAT:
      safe_buffer_length_increment(pStubMsg, 4);
      pMemory += 4;
      break;
    case FC_INT3264:
    case FC_UINT3264:
      safe_buffer_length_increment(pStubMsg, 4);
      pMemory += sizeof(INT_PTR);
      break;
    case FC_HYPER:
    case FC_DOUBLE:
      safe_buffer_length_increment(pStubMsg, 8);
      pMemory += 8;
      break;
    case FC_RP:
    case FC_UP:
    case FC_OP:
    case FC_FP:
    case FC_POINTER:
      if (*pFormat != FC_POINTER)
        pPointer = pFormat;
      if (!pStubMsg->IgnoreEmbeddedPointers)
      {
        int saved_buffer_length = pStubMsg->BufferLength;
        pStubMsg->BufferLength = pStubMsg->PointerLength;
        pStubMsg->PointerLength = 0;
        if(!pStubMsg->BufferLength)
          ERR("BufferLength == 0??\n");
        PointerBufferSize(pStubMsg, *(unsigned char**)pMemory, pPointer);
        pStubMsg->PointerLength = pStubMsg->BufferLength;
        pStubMsg->BufferLength = saved_buffer_length;
      }
      if (*pPointer != FC_RP)
      {
        align_length(&pStubMsg->BufferLength, 4);
        safe_buffer_length_increment(pStubMsg, 4);
      }
      if (*pFormat == FC_POINTER)
        pPointer += 4;
      else
        pFormat += 4;
      pMemory += sizeof(void*);
      break;
    case FC_ALIGNM2:
      align_pointer_offset(&pMemory, mem_base, 2);
      break;
    case FC_ALIGNM4:
      align_pointer_offset(&pMemory, mem_base, 4);
      break;
    case FC_ALIGNM8:
      align_pointer_offset(&pMemory, mem_base, 8);
      break;
    case FC_STRUCTPAD1:
    case FC_STRUCTPAD2:
    case FC_STRUCTPAD3:
    case FC_STRUCTPAD4:
    case FC_STRUCTPAD5:
    case FC_STRUCTPAD6:
    case FC_STRUCTPAD7:
      pMemory += *pFormat - FC_STRUCTPAD1 + 1;
      break;
    case FC_EMBEDDED_COMPLEX:
      pMemory += pFormat[1];
      pFormat += 2;
      desc = pFormat + *(const SHORT*)pFormat;
      size = EmbeddedComplexSize(pStubMsg, desc);
      m = NdrBufferSizer[*desc & NDR_TABLE_MASK];
      if (m)
      {
        /* for some reason interface pointers aren't generated as
         * FC_POINTER, but instead as FC_EMBEDDED_COMPLEX, yet
         * they still need the dereferencing treatment that pointers are
         * given */
        if (*desc == FC_IP)
          m(pStubMsg, *(unsigned char **)pMemory, desc);
        else
          m(pStubMsg, pMemory, desc);
      }
      else FIXME("no buffersizer for embedded type %02x\n", *desc);
      pMemory += size;
      pFormat += 2;
      continue;
    case FC_PAD:
      break;
    default:
      FIXME("unhandled format 0x%02x\n", *pFormat);
    }
    pFormat++;
  }
 
  return pMemory;
}
 
static unsigned char * ComplexFree(PMIDL_STUB_MESSAGE pStubMsg,
                                   unsigned char *pMemory,
                                   PFORMAT_STRING pFormat,
                                   PFORMAT_STRING pPointer)
{
  unsigned char *mem_base = pMemory;
  PFORMAT_STRING desc;
  NDR_FREE m;
  ULONG size;
 
  while (*pFormat != FC_END) {
    switch (*pFormat) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
      pMemory += 1;
      break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
      pMemory += 2;
      break;
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM16:
    case FC_ENUM32:
    case FC_FLOAT:
      pMemory += 4;
      break;
    case FC_INT3264:
    case FC_UINT3264:
      pMemory += sizeof(INT_PTR);
      break;
    case FC_HYPER:
    case FC_DOUBLE:
      pMemory += 8;
      break;
    case FC_RP:
    case FC_UP:
    case FC_OP:
    case FC_FP:
    case FC_POINTER:
      if (*pFormat != FC_POINTER)
        pPointer = pFormat;
      NdrPointerFree(pStubMsg, *(unsigned char**)pMemory, pPointer);
      if (*pFormat == FC_POINTER)
        pPointer += 4;
      else
        pFormat += 4;
      pMemory += sizeof(void *);
      break;
    case FC_ALIGNM2:
      align_pointer_offset(&pMemory, mem_base, 2);
      break;
    case FC_ALIGNM4:
      align_pointer_offset(&pMemory, mem_base, 4);
      break;
    case FC_ALIGNM8:
      align_pointer_offset(&pMemory, mem_base, 8);
      break;
    case FC_STRUCTPAD1:
    case FC_STRUCTPAD2:
    case FC_STRUCTPAD3:
    case FC_STRUCTPAD4:
    case FC_STRUCTPAD5:
    case FC_STRUCTPAD6:
    case FC_STRUCTPAD7:
      pMemory += *pFormat - FC_STRUCTPAD1 + 1;
      break;
    case FC_EMBEDDED_COMPLEX:
      pMemory += pFormat[1];
      pFormat += 2;
      desc = pFormat + *(const SHORT*)pFormat;
      size = EmbeddedComplexSize(pStubMsg, desc);
      m = NdrFreer[*desc & NDR_TABLE_MASK];
      if (m)
      {
        /* for some reason interface pointers aren't generated as
         * FC_POINTER, but instead as FC_EMBEDDED_COMPLEX, yet
         * they still need the dereferencing treatment that pointers are
         * given */
        if (*desc == FC_IP)
          m(pStubMsg, *(unsigned char **)pMemory, desc);
        else
          m(pStubMsg, pMemory, desc);
      }
      pMemory += size;
      pFormat += 2;
      continue;
    case FC_PAD:
      break;
    default:
      FIXME("unhandled format 0x%02x\n", *pFormat);
    }
    pFormat++;
  }
 
  return pMemory;
}
 
static ULONG ComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                     PFORMAT_STRING pFormat,
                                     PFORMAT_STRING pPointer)
{
  PFORMAT_STRING desc;
  ULONG size = 0;
 
  while (*pFormat != FC_END) {
    switch (*pFormat) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
      size += 1;
      safe_buffer_increment(pStubMsg, 1);
      break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
      size += 2;
      safe_buffer_increment(pStubMsg, 2);
      break;
    case FC_ENUM16:
      size += 4;
      safe_buffer_increment(pStubMsg, 2);
      break;
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM32:
    case FC_FLOAT:
      size += 4;
      safe_buffer_increment(pStubMsg, 4);
      break;
    case FC_INT3264:
    case FC_UINT3264:
      size += sizeof(INT_PTR);
      safe_buffer_increment(pStubMsg, 4);
      break;
    case FC_HYPER:
    case FC_DOUBLE:
      size += 8;
      safe_buffer_increment(pStubMsg, 8);
      break;
    case FC_RP:
    case FC_UP:
    case FC_OP:
    case FC_FP:
    case FC_POINTER:
    {
      unsigned char *saved_buffer;
      BOOL pointer_buffer_mark_set = FALSE;
      if (*pFormat != FC_POINTER)
        pPointer = pFormat;
      if (*pPointer != FC_RP)
        align_pointer(&pStubMsg->Buffer, 4);
      saved_buffer = pStubMsg->Buffer;
      if (pStubMsg->PointerBufferMark)
      {
        pStubMsg->Buffer = pStubMsg->PointerBufferMark;
        pStubMsg->PointerBufferMark = NULL;
        pointer_buffer_mark_set = TRUE;
      }
      else if (*pPointer != FC_RP)
        safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
 
      if (!pStubMsg->IgnoreEmbeddedPointers)
        PointerMemorySize(pStubMsg, saved_buffer, pPointer);
      if (pointer_buffer_mark_set)
      {
        STD_OVERFLOW_CHECK(pStubMsg);
        pStubMsg->PointerBufferMark = pStubMsg->Buffer;
        pStubMsg->Buffer = saved_buffer;
        if (*pPointer != FC_RP)
          safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
      }
      if (*pFormat == FC_POINTER)
        pPointer += 4;
      else
        pFormat += 4;
      size += sizeof(void *);
      break;
    }
    case FC_ALIGNM2:
      align_length(&size, 2);
      break;
    case FC_ALIGNM4:
      align_length(&size, 4);
      break;
    case FC_ALIGNM8:
      align_length(&size, 8);
      break;
    case FC_STRUCTPAD1:
    case FC_STRUCTPAD2:
    case FC_STRUCTPAD3:
    case FC_STRUCTPAD4:
    case FC_STRUCTPAD5:
    case FC_STRUCTPAD6:
    case FC_STRUCTPAD7:
      size += *pFormat - FC_STRUCTPAD1 + 1;
      break;
    case FC_EMBEDDED_COMPLEX:
      size += pFormat[1];
      pFormat += 2;
      desc = pFormat + *(const SHORT*)pFormat;
      size += EmbeddedComplexMemorySize(pStubMsg, desc);
      pFormat += 2;
      continue;
    case FC_PAD:
      break;
    default:
      FIXME("unhandled format 0x%02x\n", *pFormat);
    }
    pFormat++;
  }
 
  return size;
}
 
ULONG ComplexStructSize(PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
{
  PFORMAT_STRING desc;
  ULONG size = 0;
 
  while (*pFormat != FC_END) {
    switch (*pFormat) {
    case FC_BYTE:
    case FC_CHAR:
    case FC_SMALL:
    case FC_USMALL:
      size += 1;
      break;
    case FC_WCHAR:
    case FC_SHORT:
    case FC_USHORT:
      size += 2;
      break;
    case FC_LONG:
    case FC_ULONG:
    case FC_ENUM16:
    case FC_ENUM32:
    case FC_FLOAT:
      size += 4;
      break;
    case FC_INT3264:
    case FC_UINT3264:
      size += sizeof(INT_PTR);
      break;
    case FC_HYPER:
    case FC_DOUBLE:
      size += 8;
      break;
    case FC_RP:
    case FC_UP:
    case FC_OP:
    case FC_FP:
    case FC_POINTER:
      size += sizeof(void *);
      if (*pFormat != FC_POINTER)
        pFormat += 4;
      break;
    case FC_ALIGNM2:
      align_length(&size, 2);
      break;
    case FC_ALIGNM4:
      align_length(&size, 4);
      break;
    case FC_ALIGNM8:
      align_length(&size, 8);
      break;
    case FC_STRUCTPAD1:
    case FC_STRUCTPAD2:
    case FC_STRUCTPAD3:
    case FC_STRUCTPAD4:
    case FC_STRUCTPAD5:
    case FC_STRUCTPAD6:
    case FC_STRUCTPAD7:
      size += *pFormat - FC_STRUCTPAD1 + 1;
      break;
    case FC_EMBEDDED_COMPLEX:
      size += pFormat[1];
      pFormat += 2;
      desc = pFormat + *(const SHORT*)pFormat;
      size += EmbeddedComplexSize(pStubMsg, desc);
      pFormat += 2;
      continue;
    case FC_PAD:
      break;
    default:
      FIXME("unhandled format 0x%02x\n", *pFormat);
    }
    pFormat++;
  }
 
  return size;
}
 
/***********************************************************************
 *           NdrComplexStructMarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrComplexStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                                unsigned char *pMemory,
                                                PFORMAT_STRING pFormat)
{
  PFORMAT_STRING conf_array = NULL;
  PFORMAT_STRING pointer_desc = NULL;
  unsigned char *OldMemory = pStubMsg->Memory;
  BOOL pointer_buffer_mark_set = FALSE;
  ULONG count = 0;
  ULONG max_count = 0;
  ULONG offset = 0;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  if (!pStubMsg->PointerBufferMark)
  {
    int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
    /* save buffer length */
    ULONG saved_buffer_length = pStubMsg->BufferLength;
 
    /* get the buffer pointer after complex array data, but before
     * pointer data */
    pStubMsg->BufferLength = pStubMsg->Buffer - (unsigned char *)pStubMsg->RpcMsg->Buffer;
    pStubMsg->IgnoreEmbeddedPointers = 1;
    NdrComplexStructBufferSize(pStubMsg, pMemory, pFormat);
    pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
 
    /* save it for use by embedded pointer code later */
    pStubMsg->PointerBufferMark = (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength;
    TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->PointerBufferMark - pStubMsg->Buffer));
    pointer_buffer_mark_set = TRUE;
 
    /* restore the original buffer length */
    pStubMsg->BufferLength = saved_buffer_length;
  }
 
  align_pointer_clear(&pStubMsg->Buffer, pFormat[1] + 1);
 
  pFormat += 4;
  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
  pFormat += 2;
  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
  pFormat += 2;
 
  pStubMsg->Memory = pMemory;
 
  if (conf_array)
  {
    ULONG struct_size = ComplexStructSize(pStubMsg, pFormat);
    array_compute_and_write_conformance(conf_array[0], pStubMsg,
                                        pMemory + struct_size, conf_array);
    /* these could be changed in ComplexMarshall so save them for later */
    max_count = pStubMsg->MaxCount;
    count = pStubMsg->ActualCount;
    offset = pStubMsg->Offset;
  }
 
  pMemory = ComplexMarshall(pStubMsg, pMemory, pFormat, pointer_desc);
 
  if (conf_array)
  {
    pStubMsg->MaxCount = max_count;
    pStubMsg->ActualCount = count;
    pStubMsg->Offset = offset;
    array_write_variance_and_marshall(conf_array[0], pStubMsg, pMemory,
                                      conf_array, TRUE /* fHasPointers */);
  }
 
  pStubMsg->Memory = OldMemory;
 
  if (pointer_buffer_mark_set)
  {
    pStubMsg->Buffer = pStubMsg->PointerBufferMark;
    pStubMsg->PointerBufferMark = NULL;
  }
 
  STD_OVERFLOW_CHECK(pStubMsg);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrComplexStructUnmarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrComplexStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                                  unsigned char **ppMemory,
                                                  PFORMAT_STRING pFormat,
                                                  unsigned char fMustAlloc)
{
  unsigned size = *(const WORD*)(pFormat+2);
  PFORMAT_STRING conf_array = NULL;
  PFORMAT_STRING pointer_desc = NULL;
  unsigned char *pMemory;
  BOOL pointer_buffer_mark_set = FALSE;
  ULONG count = 0;
  ULONG max_count = 0;
  ULONG offset = 0;
  ULONG array_size = 0;
 
  TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
 
  if (!pStubMsg->PointerBufferMark)
  {
    int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
    /* save buffer pointer */
    unsigned char *saved_buffer = pStubMsg->Buffer;
 
    /* get the buffer pointer after complex array data, but before
     * pointer data */
    pStubMsg->IgnoreEmbeddedPointers = 1;
    NdrComplexStructMemorySize(pStubMsg, pFormat);
    pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
 
    /* save it for use by embedded pointer code later */
    pStubMsg->PointerBufferMark = pStubMsg->Buffer;
    TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->PointerBufferMark - saved_buffer));
    pointer_buffer_mark_set = TRUE;
 
    /* restore the original buffer */
    pStubMsg->Buffer = saved_buffer;
  }
 
  align_pointer(&pStubMsg->Buffer, pFormat[1] + 1);
 
  pFormat += 4;
  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
  pFormat += 2;
  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
  pFormat += 2;
 
  if (conf_array)
  {
    array_size = array_read_conformance(conf_array[0], pStubMsg, conf_array);
    size += array_size;
 
    /* these could be changed in ComplexMarshall so save them for later */
    max_count = pStubMsg->MaxCount;
    count = pStubMsg->ActualCount;
    offset = pStubMsg->Offset;
  }
 
  if (!fMustAlloc && !*ppMemory)
    fMustAlloc = TRUE;
  if (fMustAlloc)
    *ppMemory = NdrAllocateZero(pStubMsg, size);
 
  pMemory = ComplexUnmarshall(pStubMsg, *ppMemory, pFormat, pointer_desc, fMustAlloc);
 
  if (conf_array)
  {
    pStubMsg->MaxCount = max_count;
    pStubMsg->ActualCount = count;
    pStubMsg->Offset = offset;
    if (fMustAlloc)
      memset(pMemory, 0, array_size);
    array_read_variance_and_unmarshall(conf_array[0], pStubMsg, &pMemory,
                                       conf_array, FALSE,
                                       FALSE /* fUseBufferMemoryServer */,
                                       TRUE /* fUnmarshall */);
  }
 
  if (pointer_buffer_mark_set)
  {
    pStubMsg->Buffer = pStubMsg->PointerBufferMark;
    pStubMsg->PointerBufferMark = NULL;
  }
 
  return NULL;
}
 
/***********************************************************************
 *           NdrComplexStructBufferSize [RPCRT4.@]
 */
void WINAPI NdrComplexStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                       unsigned char *pMemory,
                                       PFORMAT_STRING pFormat)
{
  PFORMAT_STRING conf_array = NULL;
  PFORMAT_STRING pointer_desc = NULL;
  unsigned char *OldMemory = pStubMsg->Memory;
  int pointer_length_set = 0;
  ULONG count = 0;
  ULONG max_count = 0;
  ULONG offset = 0;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  align_length(&pStubMsg->BufferLength, pFormat[1] + 1);
 
  if(!pStubMsg->IgnoreEmbeddedPointers && !pStubMsg->PointerLength)
  {
    int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
    ULONG saved_buffer_length = pStubMsg->BufferLength;
 
    /* get the buffer length after complex struct data, but before
     * pointer data */
    pStubMsg->IgnoreEmbeddedPointers = 1;
    NdrComplexStructBufferSize(pStubMsg, pMemory, pFormat);
    pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
 
    /* save it for use by embedded pointer code later */
    pStubMsg->PointerLength = pStubMsg->BufferLength;
    pointer_length_set = 1;
    TRACE("difference = 0x%x\n", pStubMsg->PointerLength - saved_buffer_length);
 
    /* restore the original buffer length */
    pStubMsg->BufferLength = saved_buffer_length;
  }
 
  pFormat += 4;
  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
  pFormat += 2;
  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
  pFormat += 2;
 
  pStubMsg->Memory = pMemory;
 
  if (conf_array)
  {
    ULONG struct_size = ComplexStructSize(pStubMsg, pFormat);
    array_compute_and_size_conformance(conf_array[0], pStubMsg, pMemory + struct_size,
                                       conf_array);
 
    /* these could be changed in ComplexMarshall so save them for later */
    max_count = pStubMsg->MaxCount;
    count = pStubMsg->ActualCount;
    offset = pStubMsg->Offset;
  }
 
  pMemory = ComplexBufferSize(pStubMsg, pMemory, pFormat, pointer_desc);
 
  if (conf_array)
  {
    pStubMsg->MaxCount = max_count;
    pStubMsg->ActualCount = count;
    pStubMsg->Offset = offset;
    array_buffer_size(conf_array[0], pStubMsg, pMemory, conf_array,
                      TRUE /* fHasPointers */);
  }
 
  pStubMsg->Memory = OldMemory;
 
  if(pointer_length_set)
  {
    pStubMsg->BufferLength = pStubMsg->PointerLength;
    pStubMsg->PointerLength = 0;
  }
 
}
 
/***********************************************************************
 *           NdrComplexStructMemorySize [RPCRT4.@]
 */
ULONG WINAPI NdrComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                        PFORMAT_STRING pFormat)
{
  unsigned size = *(const WORD*)(pFormat+2);
  PFORMAT_STRING conf_array = NULL;
  PFORMAT_STRING pointer_desc = NULL;
  ULONG count = 0;
  ULONG max_count = 0;
  ULONG offset = 0;
 
  TRACE("(%p,%p)\n", pStubMsg, pFormat);
 
  align_pointer(&pStubMsg->Buffer, pFormat[1] + 1);
 
  pFormat += 4;
  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
  pFormat += 2;
  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
  pFormat += 2;
 
  if (conf_array)
  {
    array_read_conformance(conf_array[0], pStubMsg, conf_array);
 
    /* these could be changed in ComplexStructMemorySize so save them for
     * later */
    max_count = pStubMsg->MaxCount;
    count = pStubMsg->ActualCount;
    offset = pStubMsg->Offset;
  }
 
  ComplexStructMemorySize(pStubMsg, pFormat, pointer_desc);
 
  if (conf_array)
  {
    pStubMsg->MaxCount = max_count;
    pStubMsg->ActualCount = count;
    pStubMsg->Offset = offset;
    array_memory_size(conf_array[0], pStubMsg, conf_array,
                      TRUE /* fHasPointers */);
  }
 
  return size;
}
 
/***********************************************************************
 *           NdrComplexStructFree [RPCRT4.@]
 */
void WINAPI NdrComplexStructFree(PMIDL_STUB_MESSAGE pStubMsg,
                                 unsigned char *pMemory,
                                 PFORMAT_STRING pFormat)
{
  PFORMAT_STRING conf_array = NULL;
  PFORMAT_STRING pointer_desc = NULL;
  unsigned char *OldMemory = pStubMsg->Memory;
 
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
  pFormat += 4;
  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
  pFormat += 2;
  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
  pFormat += 2;
 
  pStubMsg->Memory = pMemory;
 
  pMemory = ComplexFree(pStubMsg, pMemory, pFormat, pointer_desc);
 
  if (conf_array)
    array_free(conf_array[0], pStubMsg, pMemory, conf_array,
               TRUE /* fHasPointers */);
 
  pStubMsg->Memory = OldMemory;
}
 
/***********************************************************************
 *           NdrConformantArrayMarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrConformantArrayMarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                                  unsigned char *pMemory,
                                                  PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
  if (pFormat[0] != FC_CARRAY)
  {
    ERR("invalid format = 0x%x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  array_compute_and_write_conformance(FC_CARRAY, pStubMsg, pMemory,
                                      pFormat);
  array_write_variance_and_marshall(FC_CARRAY, pStubMsg, pMemory, pFormat,
                                    TRUE /* fHasPointers */);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrConformantArrayUnmarshall [RPCRT4.@]
 */
unsigned char * WINAPI NdrConformantArrayUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
                                                    unsigned char **ppMemory,
                                                    PFORMAT_STRING pFormat,
                                                    unsigned char fMustAlloc)
{
  TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
  if (pFormat[0] != FC_CARRAY)
  {
    ERR("invalid format = 0x%x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  array_read_conformance(FC_CARRAY, pStubMsg, pFormat);
  array_read_variance_and_unmarshall(FC_CARRAY, pStubMsg, ppMemory, pFormat,
                                     fMustAlloc,
                                     TRUE /* fUseBufferMemoryServer */,
                                     TRUE /* fUnmarshall */);
 
  return NULL;
}
 
/***********************************************************************
 *           NdrConformantArrayBufferSize [RPCRT4.@]
 */
void WINAPI NdrConformantArrayBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
                                         unsigned char *pMemory,
                                         PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
  if (pFormat[0] != FC_CARRAY)
  {
    ERR("invalid format = 0x%x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  array_compute_and_size_conformance(FC_CARRAY, pStubMsg, pMemory, pFormat);
  array_buffer_size(FC_CARRAY, pStubMsg, pMemory, pFormat,
                    TRUE /* fHasPointers */);
}
 
/***********************************************************************
 *           NdrConformantArrayMemorySize [RPCRT4.@]
 */
ULONG WINAPI NdrConformantArrayMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
                                          PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p)\n", pStubMsg, pFormat);
  if (pFormat[0] != FC_CARRAY)
  {
    ERR("invalid format = 0x%x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  array_read_conformance(FC_CARRAY, pStubMsg, pFormat);
  array_memory_size(FC_CARRAY, pStubMsg, pFormat, TRUE /* fHasPointers */);
 
  return pStubMsg->MemorySize;
}
 
/***********************************************************************
 *           NdrConformantArrayFree [RPCRT4.@]
 */
void WINAPI NdrConformantArrayFree(PMIDL_STUB_MESSAGE pStubMsg,
                                   unsigned char *pMemory,
                                   PFORMAT_STRING pFormat)
{
  TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
  if (pFormat[0] != FC_CARRAY)
  {
    ERR("invalid format = 0x%x\n", pFormat[0]);
    RpcRaiseException(RPC_X_BAD_STUB_DATA);
  }
 
  array_free(FC_CARRAY, pStubMsg, pMemory, pFormat,
             TRUE /* fHasPointers */);
}
 
 
/***********************************************************************
 *           NdrConformantVaryingArrayMarshall  [RPCRT4.@]
 */
unsigned char* WINAPI NdrConformantVaryingArrayMarshall( PMIDL_STUB_MESSAGE pStubMsg,
                                                         unsigned char* pMemory,
                                                         PFORMAT_STRING pFormat )
{
    TRACE("(%p, %p, %p)\n", pStubMsg, pMemory, pFormat);
 
    if (pFormat[0] != FC_CVARRAY)
    {
        ERR("invalid format type %x\n", pFormat[0]);
        RpcRaiseException(RPC_S_INTERNAL_ERROR);
        return NULL;
    }
 
    array_compute_and_write_conformance(FC_CVARRAY, pStubMsg, pMemory,
                                        pFormat);
    array_write_variance_and_marshall(FC_CVARRAY, pStubMsg, pMemory,
                                      pFormat, TRUE /* fHasPointers */);
 
    return NULL;
}
 
 
/***********************************************************************
 *           NdrConformantVaryingArrayUnmarshall  [RPCRT4.@]
 */
unsigned char* WINAPI NdrConformantVaryingArrayUnmarshall( PMIDL_STUB_MESSAGE pStubMsg,
                                                           unsigned char** ppMemory,
                                                           PFORMAT_STRING pFormat,
                                                           unsigned char fMustAlloc )
{
    TRACE("(%p, %p, %p, %d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
 
    if (pFormat[0] != FC_CVARRAY)
    {
        ERR("invalid format type %x\n", pFormat[0]);
        RpcRaiseException(RPC_S_INTERNAL_ERROR);
        return NULL;
    }
 
    array_read_conformance(FC_CVARRAY, pStubMsg, pFormat);
    array_read_variance_and_unmarshall(FC_CVARRAY, pStubMsg, ppMemory,
                                       pFormat, fMustAlloc,
                                       TRUE /* fUseBufferMemoryServer */,
                                       TRUE /* fUnmarshall */);
 
    return NULL;
}
 
 
/***********************************************************************
 *           NdrConformantVaryingArrayFree  [RPCRT4.@]
 */
void WINAPI NdrConformantVaryingArrayFree( PMIDL_STUB_MESSAGE pStubMsg,
                                           unsigned char* pMemory,
                                           PFORMAT_STRING pFormat )
{
    TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
 
    if (pFormat[0] != FC_CVARRAY)
    {
        ERR("invalid format type %x\n", pFormat[0]);
        RpcRaiseException(RPC_S_INTERNAL_ERROR);
        return;
    }
 
    array_free(FC_CVARRAY, pStubMsg, pMemory, pFormat,
               TRUE /* fHasPointers */);
}
 
 
/***********************************************************************
 *           NdrConformantVaryingArrayBufferSize  [RPCRT4.@]
 */
void WINAPI NdrConformantVaryingArrayBufferSize( PMIDL_STUB_MESSAGE pStubMsg,
                                                 unsigned char* pMemory, PFORMAT_STRING pFormat )
{
    TRACE("(%p, %p, %p)\n", pStubMsg, pMemory, pFormat);
 
    if (pFormat[0] != FC_CVARRAY)
    {
        ERR("invalid format type %x\n", pFormat[0]);
        RpcRaiseException(RPC_S_INTERNAL_ERROR);
        return;
    }
 
    array_compute_and_size_conformance(FC_CVARRAY, pStubMsg, pMemory,
                                       pFormat);
    array_buffer_size(FC_CVARRAY, pStubMsg, pMemory, pFormat,
                      TRUE /* fHasPointers */);
}
 
 
/***********************************************************************
 *           NdrConformantVaryingArrayMemorySize  [RPCRT4.@]
 */
ULONG WINAPI NdrConformantVaryingArrayMemorySize( PMIDL_STUB_MESSAGE pStubMsg,
                                                  PFORMAT_STRING pFormat )
{
    TRACE("(%p, %p)\n", pStubMsg, pFormat);
 
    if (pFormat[0] != FC_CVARRAY)
    {
        ERR("invalid format type %x\n", pFormat[0]);
        RpcRaiseException(RPC_S_INTERNAL_ERROR);
        return pStubMsg->MemorySize;
    }
 
    array_read_conformance(FC_CVARRAY, pStubMsg, pFormat);
    array_memory_size(FC_CVARRAY, pStubMsg, pFormat,
                      TRUE /* fHasPointers */);
 
<